@allocator-one/harness-cli 1.16.0 → 1.17.1

package/dist/cli.js

@@ -1,57 +1,44 @@
 #!/usr/bin/env node
+import {
+  UPDATE_CHECK_COMMAND,
+  guardBrokenPipes,
+  operatorDeprecationNotice,
+  performUpdateCheck,
+  selfHeal,
+  updateCheck
+} from "./chunk-67NX7MJ2.js";
 import {
   ACTIVITY_MAX_LIMIT,
-  Client,
-  CommandError,
-  DEFAULT_BASE_URL,
   EXIT_INTERRUPTED,
   EXIT_JOB_ENDED,
   EXIT_WAITING_FOR_PERSON,
-  EXPERT_ASSIGNMENTS_PATH,
-  EXPERT_LAPSED,
-  HttpError,
   JOBS_MAX_LIMIT,
   JOBS_MAX_PAGES,
   JOB_STATES,
-  LocalError,
   PLAN_LIST_MAX_LIMIT,
   PLAN_STATUSES,
   RELATION_CREATE_TYPES,
   RELATION_UPDATE_TYPES,
-  SESSION_PATH,
   STEER_MAX_CHARACTERS,
-  TransportError,
-  UpgradeRequiredError,
-  UsageError,
   activity,
   archive,
   assignments,
   attachImage,
   blocked,
-  clean,
   close,
   comment,
   comments,
   conditionList,
   create,
-  defaultCredentialsPath,
   deleteComment,
-  deleteCredentials,
   dep,
   docCreate,
   docList,
   docShow,
   docUpdate,
   editComment,
-  errorDetails,
-  expertSummary,
-  explainExpertRefusal,
-  findRepoConfig,
   gateSet,
   instructionFrom,
-  isExpertToken,
-  isHostTrusted,
-  isLoginCredential,
   jobCancel,
   jobContinue,
   jobPause,
@@ -59,7 +46,6 @@ import {
   jobSteer,
   jobWatch,
   jobsList,
-  json,
   labelCreate,
   labelDelete,
   labelList,
@@ -69,13 +55,11 @@ import {
   linkRm,
   linkUpdate,
   list,
-  loginHelp,
   memberAdd,
   memberList,
   memberSetRole,
   milestoneCreate,
   milestoneList,
-  orgCredentialsPath,
   planCreate,
   planEdit,
   planHold,
@@ -91,7 +75,6 @@ import {
   projectList,
   projectShow,
   projectUpdate,
-  readCredentials,
   readPlanFile,
   ready,
   relationAdd,
@@ -113,8 +96,6 @@ import {
   requireSearchQuery,
   requireToolsOpts,
   requiredTeam,
-  resolveCacheHome,
-  resolveConfig,
   resolveTextSources,
   run,
   search,
@@ -134,28 +115,50 @@ import {
   toolsDomains,
   toolsList,
   toolsSearch,
-  trustHost,
   update,
   upload,
   userList,
-  validOrgId,
-  validateBaseUrl,
   validateIdempotencyKey,
   version,
   watchStopSignal,
-  workflowStates,
-  writeCredentials
-} from "./chunk-GVTZKAXC.js";
+  workflowStates
+} from "./chunk-CEEQW6ZV.js";
+import {
+  login,
+  logout,
+  whoami
+} from "./chunk-WSDFLMO6.js";
+import {
+  Client,
+  CommandError,
+  DEFAULT_BASE_URL,
+  HttpError,
+  LocalError,
+  TransportError,
+  UpgradeRequiredError,
+  UsageError,
+  clean,
+  defaultCredentialsPath,
+  errorDetails,
+  explainExpertRefusal,
+  findRepoConfig,
+  isHostTrusted,
+  json,
+  loginHelp,
+  readCredentials,
+  resolveCacheHome,
+  resolveConfig,
+  trustHost
+} from "./chunk-BHBEIT5I.js";
 import {
   CLI_VERSION,
-  OPERATOR_PACKAGE,
   invokedName,
   layoutOperatorHelp,
   named
-} from "./chunk-FQWV5MIC.js";
+} from "./chunk-5THYIKLW.js";
 
 // src/cli.ts
-import { createInterface as createInterface2 } from "readline";
+import { createInterface } from "readline";
 import { Command, CommanderError, InvalidArgumentError } from "commander";
 
 // src/commands/keys.ts
@@ -209,9 +212,9 @@ function selectSlugs(stored, only) {
 function unknownSlugs(only) {
   return only.map((slug) => slug.trim()).filter((slug) => slug !== "" && !KEY_ENV_VARS.has(slug.toLowerCase()));
 }
-function withholdOthers(base, requested) {
+function withholdOthers(base2, requested) {
   const keep = new Set(requested.map((slug) => envVarFor(slug)));
-  const env = { ...base };
+  const env = { ...base2 };
   for (const name of KEY_ENV_VARS.values()) {
     if (!keep.has(name)) delete env[name];
   }
@@ -229,9 +232,9 @@ function toEnv(stored) {
   }
   return env;
 }
-function childEnv(base, fetched, override) {
+function childEnv(base2, fetched, override) {
   const env = {};
-  for (const [name, value] of Object.entries(base)) {
+  for (const [name, value] of Object.entries(base2)) {
     if (value !== void 0) env[name] = value;
   }
   for (const [name, value] of Object.entries(fetched)) {
@@ -240,8 +243,8 @@ function childEnv(base, fetched, override) {
   }
   return env;
 }
-function exitCodeFor(code, signal) {
-  if (code !== null) return code;
+function exitCodeFor(code2, signal) {
+  if (code2 !== null) return code2;
   if (signal !== null) {
     const number = constants.signals[signal];
     if (typeof number === "number") return 128 + number;
@@ -295,13 +298,13 @@ async function exec(ctx, opts) {
     opts.override
   );
   const name = clean(program2);
-  const exitCode = await new Promise((resolve, reject) => {
+  const exitCode = await new Promise((resolve3, reject) => {
     let child;
     try {
       child = spawn(program2, args, { stdio: "inherit", env });
     } catch (error) {
-      const code = error.code ?? "invalid arguments";
-      reject(new CommandError(`cannot start ${name}: ${code}`));
+      const code2 = error.code ?? "invalid arguments";
+      reject(new CommandError(`cannot start ${name}: ${code2}`));
       return;
     }
     const handlers = [];
@@ -331,12 +334,12 @@ async function exec(ctx, opts) {
     });
     child.on("error", (error) => {
       settle(() => {
-        const code = error.code ?? error.message;
-        reject(new CommandError(spawned ? `${name} failed: ${code}` : `cannot run ${name}: ${code}`));
+        const code2 = error.code ?? error.message;
+        reject(new CommandError(spawned ? `${name} failed: ${code2}` : `cannot run ${name}: ${code2}`));
       });
     });
-    child.on("exit", (code, signal) => {
-      settle(() => resolve(exitCodeFor(code, signal)));
+    child.on("exit", (code2, signal) => {
+      settle(() => resolve3(exitCodeFor(code2, signal)));
     });
   });
   return { json: { exit_code: exitCode }, human: "", exitCode };
@@ -490,8 +493,8 @@ async function retry(ctx, pr, reason) {
     response = await ctx.client.post(`${gatePath(pr)}/retry`, body, { actor: false });
   } catch (error) {
     if (error instanceof HttpError && error.status === 409) {
-      const code = error.message.trim().split(/[\s:]+/).pop() ?? "";
-      throw new CommandError(`could not retry ${label(pr)}: ${REFUSALS[code] ?? clean(error.message)}`);
+      const code2 = error.message.trim().split(/[\s:]+/).pop() ?? "";
+      throw new CommandError(`could not retry ${label(pr)}: ${REFUSALS[code2] ?? clean(error.message)}`);
     }
     if (error instanceof HttpError && error.status === 403) {
       throw new CommandError(`${error.message} \u2014 a retry needs a login with reviews:write`);
@@ -508,1192 +511,1832 @@ async function retry(ctx, pr, reason) {
   };
 }
 
-// src/core/auth.ts
-import { createHash, randomBytes } from "crypto";
-import { execFile } from "child_process";
-import { accessSync, constants as fsConstants } from "fs";
-import { createServer } from "http";
-import { delimiter, join } from "path";
-import { createInterface } from "readline";
-var DEFAULT_TIMEOUT_MS = 18e4;
-var RESPONSE_DRAIN_GRACE_MS = 100;
-var RESPONSE_FLUSH_TIMEOUT_MS = 2e3;
-var MAX_PAGE_RESPONSES = 4;
-var loginPageImport;
-function loadLoginPage() {
-  loginPageImport ??= import("./login-page-KGEJFFXR.js");
-  return loginPageImport;
-}
-var NO_SESSION = { kind: null, expires_at: null, scopes: null, user: null, org: null };
-function generateState() {
-  return randomBytes(24).toString("base64url");
-}
-function generateVerifier() {
-  return randomBytes(32).toString("base64url");
-}
-function challengeFor(verifier) {
-  return createHash("sha256").update(verifier).digest("base64url");
-}
-async function login(baseUrl, options = {}) {
-  const validated = validateBaseUrl(baseUrl);
-  if (!validated.ok) return { ok: false, message: validated.message };
-  if (options.org !== void 0 && !validOrgId(options.org)) {
-    return { ok: false, message: "org must be an organization UUID" };
-  }
-  const base = baseUrl.replace(/\/+$/, "");
-  if (options.noBrowser === true || !browserAvailable(options)) {
-    return manualLogin(base, options);
-  }
-  return loopbackLogin(base, options);
-}
-function browserAvailable(options) {
-  if ("openBrowser" in options) return typeof options.openBrowser === "function";
-  return browserOpener() !== null && displayAvailable(options.env ?? process.env);
-}
-function findExecutable(name, pathVar = process.env["PATH"]) {
-  for (const dir of (pathVar ?? "").split(delimiter)) {
-    if (dir === "") continue;
-    const candidate = join(dir, name);
-    try {
-      accessSync(candidate, fsConstants.X_OK);
-      return candidate;
-    } catch {
-    }
-  }
-  return null;
-}
-function browserOpener() {
-  const name = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
-  if (name === null) return null;
-  return findExecutable(name);
-}
-function displayAvailable(env) {
-  const display = env["DISPLAY"];
-  const remote = isSet(env["SSH_CONNECTION"]) || isSet(env["SSH_TTY"]);
-  const hasDisplay = isSet(display) || isSet(env["WAYLAND_DISPLAY"]);
-  const forwarded = typeof display === "string" && display.startsWith("localhost:");
-  if (process.platform === "darwin") return !remote;
-  if (process.platform === "linux") return hasDisplay && (!remote || forwarded);
-  return !remote;
-}
-function isSet(value) {
-  return value !== void 0 && value !== "";
-}
-async function loopbackLogin(baseUrl, options) {
-  const notify = options.notify ?? defaultNotify;
-  const state2 = generateState();
-  const verifier = generateVerifier();
-  const challenge = challengeFor(verifier);
-  const server = createServer();
-  const port = await new Promise((resolve) => {
-    server.once("error", () => resolve(null));
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      resolve(typeof address === "object" && address !== null ? address.port : null);
-    });
-  });
-  if (port === null) {
-    return {
-      ok: false,
-      message: "could not open a loopback port for the browser handoff"
-    };
-  }
+// src/commands/code/index.ts
+import { resolve as resolve2 } from "path";
+import { statSync, realpathSync } from "fs";
+
+// src/core/code/http.ts
+import { setTimeout as delay } from "timers/promises";
+import { z } from "zod";
+var UUID = z.string().uuid();
+var HASH = z.string().regex(/^[a-f0-9]{64}$/);
+var view = z.object({
+  view_id: UUID,
+  view_key: z.string(),
+  repository_id: UUID,
+  active: z.object({
+    version: z.number().int(),
+    base_commit: z.string(),
+    overlay_digest: HASH,
+    indexed_at: z.string().nullable().optional()
+  }).nullable(),
+  pending: z.object({
+    version: z.number().int(),
+    state: z.string(),
+    progress: z.object({ done: z.number().int().nonnegative(), total: z.number().int().nonnegative() }).nullable().optional(),
+    error: z.unknown().optional()
+  }).nullable()
+});
+var policy = z.object({
+  org_id: UUID,
+  policy_digest: z.string().min(1).max(256),
+  max_file_bytes: z.number().int().positive(),
+  max_batch_bytes: z.number().int().positive(),
+  include_extensions: z.array(z.string().max(32)).max(100),
+  deny_globs: z.array(z.string().max(1024)).max(1e3),
+  deny_glob_case: z.literal("ascii_insensitive").optional(),
+  content_patterns: z.array(z.string().max(4096)).max(100),
+  org_name: z.string().optional()
+});
+var base = z.object({
+  state: z.enum(["fetching", "complete", "ready", "failed"]),
+  policy_digest: z.string().optional(),
+  file_count: z.number().optional(),
+  excluded_count: z.number().optional(),
+  skipped: z.array(z.object({ path: z.string(), reason: z.string() })).optional(),
+  error: z.unknown().optional(),
+  retry_after_ms: z.number().nonnegative().optional()
+});
+var opened = z.object({
+  sync_id: UUID,
+  state: z.string(),
+  missing: z.array(HASH),
+  rejected: z.array(z.object({ path: z.string(), error: z.string() }))
+});
+var activated = z.object({
+  pending_version: z.number().int().positive(),
+  state: z.string()
+});
+var syncStatus = z.object({
+  id: UUID,
+  state: z.enum(["receiving", "queued", "indexing", "active", "superseded", "failed"]),
+  version: z.number().int().nonnegative().nullable()
+});
+function decode(schema, data) {
+  const result = schema.safeParse(data);
+  if (!result.success)
+    throw new CommandError(
+      "The code index API returned an invalid response; no additional source will be uploaded."
+    );
+  return result.data;
+}
+function retryAfterMs(value, now = Date.now()) {
+  if (value === null) return void 0;
+  const seconds = Number(value);
+  if (/^\d+(?:\.\d+)?$/.test(value) && Number.isFinite(seconds))
+    return seconds * 1e3;
+  const date = Date.parse(value);
+  return Number.isNaN(date) ? void 0 : Math.max(0, date - now);
+}
+function describeCodeError(error) {
+  const code2 = error.body["error"];
+  let message = error.message;
+  if (code2 === "repository_not_connected")
+    message = "repository_not_connected: share this repository through your organization\u2019s Harness GitHub connection before syncing.";
+  if (code2 === "code_index_disabled")
+    message = "code_index_disabled: code indexing is disabled for this organization; ask a Harness administrator to enable it.";
+  if (code2 === "quota_exceeded") {
+    const raw = error.body["details"];
+    const d = raw && typeof raw === "object" ? raw : {};
+    message = `quota_exceeded: your organization\u2019s code index limit ${typeof d["quota"] === "string" ? d["quota"] : "quota"} is reached (limit ${typeof d["limit"] === "number" ? d["limit"] : "unknown"}). Ask a Harness administrator.`;
+  }
+  if (code2 === "invalid_sync")
+    message = "invalid_sync: the client sync request does not match the server contract. Upgrade the client and retry code sync.";
+  if (code2 === "overlay_too_large") {
+    const raw = error.body["details"];
+    const details = raw && typeof raw === "object" ? raw : {};
+    const limit = typeof details["limit"] === "number" ? details["limit"] : 2e4;
+    message = `overlay_too_large: the overlay exceeds ${limit} paths. Sync against a newer base commit.`;
+  }
+  if (code2 === "unexpected_blob")
+    message = "unexpected_blob: no open sync names this upload. Retry code sync to reconcile the overlay; base blobs are never uploaded.";
+  if (code2 === "stale_policy")
+    message = "stale_policy: the upload policy kept changing; retry code sync to fetch the policy and rescan.";
+  if (code2 === "not_view_owner")
+    message = "not_view_owner: this code view belongs to another member; sync your own worktree.";
+  if (code2 === "insufficient_scope" || code2 === "missing_scope")
+    message = "Code commands need harness:read; sync and base status also need harness:write.";
+  return new HttpError(error.status, message, error.body, error.retryAfter);
+}
+async function responseText(response, maxBytes) {
+  if (maxBytes === void 0) return response.text();
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
   try {
-    const query = new URLSearchParams({ port: String(port), state: state2, challenge });
-    const url = `${baseUrl}/cli/login?${query.toString()}`;
-    const callbackPromise = awaitCallback(server, state2, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-    void loadLoginPage().catch(() => {
-      loginPageImport = void 0;
-    });
-    const openBrowser = options.openBrowser ?? defaultOpenBrowser;
-    try {
-      openBrowser(url);
-    } catch (error) {
-      const detail = error instanceof Error ? error.message : String(error);
-      return { ok: false, message: `could not open a browser: ${detail}` };
-    }
-    if (options.org !== void 0) notify(`Choose organization ${options.org} on the login page; another organization's token will be refused.`);
-    notify(`Opening ${url}`);
-    notify("Waiting for the browser authorization (Ctrl-C to abort)\u2026");
-    const callback = await callbackPromise;
-    if (!callback.ok) return callback;
-    try {
-      const token = await exchangeCode(baseUrl, callback.code, verifier, options);
-      if (!token.ok) {
-        await callback.respond(
-          400,
-          "Harness could not exchange the browser authorization. Return to the terminal for details.",
-          "error"
-        );
-        return token;
-      }
-      const result = await verifyAndStore(baseUrl, token.token, options, { minted: true, kind: token.kind });
-      if (result.ok) {
-        await callback.respond(200, "You can close this browser and return to the terminal.", "success");
-      } else {
-        await callback.respond(
-          400,
-          "Harness could not verify and store this login. Return to the terminal for details.",
-          "error"
-        );
+    while (true) {
+      const part = await reader.read();
+      if (part.done) break;
+      size += part.value.byteLength;
+      if (size > maxBytes) {
+        void reader.cancel().catch(() => {
+        });
+        throw new CommandError("The code query response exceeds the 16 MiB size limit; narrow the query.");
       }
-      return result;
-    } catch (error) {
-      await callback.respond(500, "Harness could not finish the login. Return to the terminal for details.", "error");
-      const detail = error instanceof Error ? error.message : String(error);
-      return { ok: false, message: `could not finish the browser login: ${detail}` };
+      chunks.push(Buffer.from(part.value));
     }
   } finally {
-    server.close();
-    const forceClose = setTimeout(
-      () => server.closeAllConnections(),
-      RESPONSE_FLUSH_TIMEOUT_MS + RESPONSE_DRAIN_GRACE_MS
-    );
-    forceClose.unref();
-  }
-}
-function awaitCallback(server, state2, timeoutMs) {
-  return new Promise((resolve) => {
-    let phase = "waiting";
-    let finalResponse = null;
-    let callbackPageResponses = 0;
-    const rootPageResponses = /* @__PURE__ */ new Map();
-    const acceptedResponders = [];
-    const inFlightResponses = /* @__PURE__ */ new Set();
-    const trackResponse = (responsePromise) => {
-      inFlightResponses.add(responsePromise);
-      void responsePromise.finally(() => inFlightResponses.delete(responsePromise));
-      return responsePromise;
-    };
-    const drainTrackedResponses = async () => {
-      await new Promise((settle) => setTimeout(settle, RESPONSE_DRAIN_GRACE_MS));
-      const deadline = Date.now() + RESPONSE_FLUSH_TIMEOUT_MS;
-      while (inFlightResponses.size > 0 && Date.now() < deadline) {
-        const remaining = deadline - Date.now();
-        await Promise.race([
-          Promise.allSettled([...inFlightResponses]),
-          new Promise((settle) => setTimeout(settle, remaining))
-        ]);
-      }
-    };
-    const timer = setTimeout(() => {
-      if (phase !== "waiting") return;
-      const timeoutResponse = {
-        status: 410,
-        message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
-        pageState: "error"
-      };
-      phase = "terminal";
-      finalResponse = timeoutResponse;
-      resolve({
-        ok: false,
-        message: "timed out waiting for the browser authorization"
-      });
-      void drainTrackedResponses();
-    }, timeoutMs);
-    server.once("close", () => {
-      clearTimeout(timer);
-      if (phase !== "waiting") return;
-      phase = "terminal";
-      resolve({ ok: false, message: "the browser login listener closed before authorization completed" });
-    });
-    server.on("request", (request, response) => {
-      const respond = callbackResponder(response);
-      const respondWithPage = (status2, message, pageState) => {
-        if (callbackPageResponses >= MAX_PAGE_RESPONSES) {
-          respondEmpty(response, 429);
-          return Promise.resolve();
-        }
-        callbackPageResponses += 1;
-        return respond(status2, message, pageState);
-      };
-      const respondAtRoot = (status2, message, pageState) => {
-        const rootPhase = phase === "terminal" ? "terminal" : "waiting";
-        const responses = rootPageResponses.get(rootPhase) ?? 0;
-        if (responses >= MAX_PAGE_RESPONSES) {
-          respondEmpty(response, 429);
-          return Promise.resolve();
-        }
-        rootPageResponses.set(rootPhase, responses + 1);
-        return respond(status2, message, pageState);
-      };
-      let url;
+    reader.releaseLock();
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+  } catch {
+    throw new CommandError("The code query response is not valid UTF-8.");
+  }
+}
+var HttpCodeApi = class {
+  constructor(config, options = {}) {
+    this.config = config;
+    this.origin = config.baseUrl;
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+    this.sleep = options.sleep ?? delay;
+  }
+  config;
+  origin;
+  fetchImpl;
+  sleep;
+  async request(method, path, body, maxResponseBytes) {
+    for (let attempt = 0; attempt < 3; attempt++) {
       try {
-        url = new URL(request.url ?? "/", "http://127.0.0.1");
-      } catch {
-        respondEmpty(response, 404);
-        return;
-      }
-      const path = url.pathname.replace(/\/+$/, "") || "/";
-      if (path !== "/callback") {
-        if (path === "/") {
-          const rootResponse = phase === "terminal" && finalResponse ? finalResponse : {
-            status: 200,
-            message: "Waiting for the Harness browser authorization to finish.",
-            pageState: "waiting"
-          };
-          void trackResponse(
-            respondAtRoot(rootResponse.status, rootResponse.message, rootResponse.pageState)
-          );
-        } else {
-          respondEmpty(response, path === "/favicon.ico" ? 204 : 404);
-        }
-        return;
-      }
-      const matchingState = url.searchParams.get("state") === state2;
-      if (!matchingState) {
-        respondEmpty(response, 400);
-        return;
-      }
-      if (phase === "terminal") {
-        if (!url.searchParams.has("code") && !url.searchParams.has("error")) {
-          respondEmpty(response, 400);
-          return;
-        }
-        const result = finalResponse ?? {
-          status: 410,
-          message: `This login attempt has ended \u2014 run ${invokedName()} login again if needed.`,
-          pageState: "error"
+        const headers = {
+          authorization: `Bearer ${this.config.token}`,
+          "x-harness-cli-version": CLI_VERSION
         };
-        void trackResponse(respondWithPage(result.status, result.message, result.pageState));
-        return;
-      }
-      if (phase === "processing") {
-        if (url.searchParams.has("error")) {
-          respondEmpty(response, 409);
-          return;
-        }
-        const duplicateCode = url.searchParams.get("code");
-        if (duplicateCode === null || duplicateCode === "") {
-          respondEmpty(response, 400);
-          return;
-        }
-        if (acceptedResponders.length >= MAX_PAGE_RESPONSES) {
-          respondEmpty(response, 429);
-          return;
-        }
-        acceptedResponders.push(respondWithPage);
-        return;
-      }
-      if (url.searchParams.has("error")) {
-        const denialResponse = {
-          status: 400,
-          message: "Browser authorization was denied. Return to the terminal to try again.",
-          pageState: "error"
-        };
-        phase = "terminal";
-        finalResponse = denialResponse;
-        clearTimeout(timer);
-        void (async () => {
-          await trackResponse(respondWithPage(denialResponse.status, denialResponse.message, denialResponse.pageState));
-          await drainTrackedResponses();
-          resolve({ ok: false, message: "browser authorization was denied" });
-        })();
-        return;
-      }
-      const code = url.searchParams.get("code");
-      if (code !== null && code !== "") {
-        phase = "processing";
-        acceptedResponders.push(respondWithPage);
-        clearTimeout(timer);
-        resolve({
-          ok: true,
-          code,
-          respond: async (status2, message, pageState) => {
-            finalResponse = { status: status2, message, pageState };
-            phase = "terminal";
-            const responders = acceptedResponders.splice(0);
-            await Promise.all(
-              responders.map((acceptedRespond) => trackResponse(acceptedRespond(status2, message, pageState)))
-            );
-            await drainTrackedResponses();
+        const encoded = body === void 0 ? void 0 : Buffer.isBuffer(body) ? body : JSON.stringify(body);
+        if (body !== void 0)
+          headers["content-type"] = Buffer.isBuffer(body) ? "application/octet-stream" : "application/json";
+        const response = await this.fetchImpl(
+          new URL(this.origin + "/api/v1/code" + path),
+          {
+            method,
+            headers,
+            body: encoded,
+            signal: AbortSignal.timeout(3e4),
+            redirect: "manual"
+          }
+        );
+        const retryAfter = retryAfterMs(response.headers.get("retry-after"));
+        const text = await responseText(response, maxResponseBytes);
+        let json2 = {};
+        if (text) {
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
+              json2 = parsed;
+            else if (response.ok)
+              throw new CommandError(
+                "The code index API returned an invalid JSON envelope."
+              );
+          } catch (error) {
+            if (response.ok)
+              throw error instanceof CommandError ? error : new CommandError(
+                "The code index API returned a non-JSON body."
+              );
           }
-        });
-      } else {
-        respondEmpty(response, 400);
-      }
-    });
-  });
-}
-function callbackResponder(response) {
-  return async (status2, message, state2) => {
-    if (response.writableEnded || response.destroyed) return;
-    return new Promise((resolve) => {
-      let flushTimer;
-      const armFlushTimeout = () => {
-        if (flushTimer !== void 0) clearTimeout(flushTimer);
-        flushTimer = setTimeout(() => {
-          response.destroy();
-          settle();
-        }, RESPONSE_FLUSH_TIMEOUT_MS);
-        flushTimer.unref();
-      };
-      const settle = () => {
-        if (flushTimer !== void 0) clearTimeout(flushTimer);
-        response.off("finish", settle);
-        response.off("close", settle);
-        response.off("error", settle);
-        response.off("drain", armFlushTimeout);
-        resolve();
-      };
-      response.once("finish", settle);
-      response.once("close", settle);
-      response.once("error", settle);
-      response.on("drain", armFlushTimeout);
-      void loadLoginPage().then(({ loginPage }) => {
-        if (response.writableEnded || response.destroyed) {
-          settle();
-          return;
         }
-        try {
-          const html = loginPage(message, state2);
-          response.writeHead(status2, {
-            "cache-control": "no-store",
-            connection: "close",
-            "content-length": String(Buffer.byteLength(html)),
-            "content-type": "text/html; charset=utf-8",
-            "x-content-type-options": "nosniff"
-          });
-          armFlushTimeout();
-          response.end(html);
-        } catch {
-          response.destroy();
-          settle();
+        if (!response.ok) {
+          const message = typeof json2["message"] === "string" ? json2["message"] : `Code index request refused (HTTP ${response.status}).`;
+          if (response.status === 426)
+            throw new UpgradeRequiredError(message, json2);
+          throw new HttpError(
+            response.status,
+            message,
+            json2,
+            response.headers.get("retry-after")
+          );
         }
-      }).catch(() => {
-        response.destroy();
-        settle();
-      });
-    });
-  };
-}
-function respondEmpty(response, status2) {
-  response.once("error", () => void 0);
-  try {
-    response.writeHead(status2, {
-      "cache-control": "no-store",
-      connection: "close",
-      "x-content-type-options": "nosniff"
-    });
-    response.end();
-  } catch {
-    response.destroy();
-  }
-}
-async function exchangeCode(baseUrl, code, verifier, options) {
-  try {
-    const body = await bareClient(baseUrl, "", options).post("/api/v1/cli/token-exchange", { code, code_verifier: verifier });
-    const token = body.data?.token;
-    const kind = typeof body.data?.kind === "string" ? body.data.kind : null;
-    if (typeof token === "string" && token !== "") return { ok: true, token, kind };
-    return {
-      ok: false,
-      message: "the login-code exchange returned no token \u2014 aborting"
-    };
-  } catch (error) {
-    if (error instanceof HttpError) {
-      return {
-        ok: false,
-        message: `the login-code exchange failed: ${error.message}`
-      };
-    }
-    if (error instanceof TransportError) {
-      return {
-        ok: false,
-        message: `the login-code exchange failed: cannot reach the API (${error.message})`
-      };
-    }
-    throw error;
-  }
-}
-async function manualLogin(baseUrl, options) {
-  const notify = options.notify ?? defaultNotify;
-  const prompt = options.prompt ?? defaultPrompt;
-  if (options.org !== void 0) notify(`Choose organization ${options.org} on the login page; another organization's token will be refused.`);
-  notify(
-    `Open ${baseUrl}/cli/login in a browser, authorize, and paste the token below (an outside expert pastes the pxc_ credential minted in their expert view instead).`
-  );
-  const token = (await prompt()).trim();
-  if (token === "") return { ok: false, message: "no token entered" };
-  return verifyAndStore(baseUrl, token, options, { minted: false, kind: null });
-}
-async function verifyAndStore(baseUrl, token, options, received) {
-  const defaultPath = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
-  const path = options.org === void 0 ? defaultPath : orgCredentialsPath(defaultPath, baseUrl, options.org);
-  const client = bareClient(baseUrl, token, options);
-  const expert = isExpertToken(token);
-  let kind = received.kind;
-  try {
-    if (expert) {
-      if (options.org !== void 0) return { ok: false, message: "cannot verify an outside expert credential against a repo org \u2014 nothing was stored" };
-      await client.get(EXPERT_ASSIGNMENTS_PATH);
-    } else {
-      const described = isLoginCredential(token) ? await describeSession(client) : null;
-      if (described !== null) kind = described.session.kind ?? kind;
-      if (options.org !== void 0 && (typeof described?.session.org?.["id"] !== "string" || described.session.org["id"].toLowerCase() !== options.org.toLowerCase())) {
-        const revoked = received.minted && await revokeSession(client, token);
-        return { ok: false, message: `the received token does not verify organization ${options.org} \u2014 nothing was stored` + (revoked ? ", and the token was revoked" : "") };
+        return { data: json2["data"], meta: json2["meta"], retryAfter };
+      } catch (error) {
+        if (error instanceof UpgradeRequiredError || error instanceof CommandError)
+          throw error;
+        const transient = error instanceof HttpError ? [429, 500, 502, 503, 504].includes(error.status) : true;
+        if (!transient || attempt === 2) {
+          if (error instanceof HttpError) throw error;
+          throw new TransportError(
+            "Code index request did not complete. Retry this command with the same worktree to resume."
+          );
+        }
+        const backoff = error instanceof HttpError ? retryAfterMs(error.retryAfter) : void 0;
+        const wait = backoff ?? 250 * 2 ** attempt;
+        if (wait > 3e5)
+          throw error instanceof HttpError ? error : new TransportError(
+            "The code index retry backoff is too long; retry later."
+          );
+        await this.sleep(wait);
       }
-      if (described === null) await client.get("/api/v1/teams");
     }
-  } catch (error) {
-    if (error instanceof HttpError) {
-      const lapsed = expert && error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : "";
-      const revoked = received.minted && await revokeSession(client, token);
-      return {
-        ok: false,
-        message: `the received token failed verification (${error.message}, HTTP ${error.status}) \u2014 nothing was stored${revoked ? ", and the token was revoked" : ""}${lapsed}`
-      };
+    throw new CommandError("Code index retry limit exceeded.");
+  }
+  async query(id, operation, p) {
+    const root = `/views/${encodeURIComponent(id)}`;
+    if (operation === "affected") {
+      const result2 = await this.request("POST", root + "/affected", {
+        symbol_ids: p.symbols ?? [],
+        paths: p.files ?? [],
+        ...p.depth !== void 0 ? { depth: p.depth } : {},
+        ...p.includeAmbiguous !== void 0 ? { include_ambiguous: p.includeAmbiguous } : {},
+        ...p.includeTypes !== void 0 ? { include_types: p.includeTypes } : {}
+      }, 16 * 1024 * 1024);
+      return { data: result2.data, meta: result2.meta };
     }
-    if (error instanceof TransportError) {
-      return {
-        ok: false,
-        message: `could not verify the token: cannot reach the API (${error.message}) \u2014 nothing was stored`
-      };
+    const path = operation === "explain" ? root + `/symbols/${encodeURIComponent(p.symbol)}` : root + (operation === "search" ? "/symbols" : "/context");
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(operation === "search" ? { q: p.q, kind: p.kind, path_prefix: p.pathPrefix, limit: p.limit } : operation === "explain" ? { budget_tokens: p.budgetTokens } : { q: p.q, symbol_id: p.symbol, budget_tokens: p.budgetTokens })) {
+      if (value !== void 0) params.set(key, String(value));
     }
-    throw error;
+    const result = await this.request("GET", path + (params.size ? "?" + params.toString() : ""), void 0, 16 * 1024 * 1024);
+    return { data: result.data, meta: result.meta };
+  }
+  async getPolicy() {
+    const raw = (await this.request("GET", "/policy")).data;
+    if (raw && typeof raw === "object" && "deny_glob_case" in raw && raw.deny_glob_case !== void 0 && raw.deny_glob_case !== "ascii_insensitive")
+      throw new CommandError("The server returned an invalid code upload policy; upgrade the client before code sync.");
+    return decode(policy, raw);
+  }
+  async putRepository(repoKey) {
+    return decode(
+      z.object({ repository_id: UUID, repo_key: z.string() }),
+      (await this.request("PUT", "/repositories", { repo_key: repoKey })).data
+    );
+  }
+  async getBase(repositoryId, commit, skipped) {
+    const r = await this.request(
+      "GET",
+      `/repositories/${encodeURIComponent(repositoryId)}/bases/${encodeURIComponent(commit)}${skipped ? "?skipped=true" : ""}`
+    );
+    const data = decode(base, r.data);
+    const wait = Math.max(data.retry_after_ms ?? 0, r.retryAfter ?? 0);
+    return wait ? { ...data, retry_after_ms: wait } : data;
+  }
+  async putView(repositoryId, key) {
+    return decode(
+      view,
+      (await this.request(
+        "PUT",
+        `/repositories/${encodeURIComponent(repositoryId)}/views/${encodeURIComponent(key)}`,
+        {}
+      )).data
+    );
+  }
+  async getView(id) {
+    return decode(
+      view,
+      (await this.request("GET", `/views/${encodeURIComponent(id)}`)).data
+    );
+  }
+  async openSync(id, body) {
+    return decode(
+      opened,
+      (await this.request("POST", `/views/${encodeURIComponent(id)}/syncs`, {
+        ...body
+      })).data
+    );
+  }
+  async putBlob(hash2, bytes) {
+    if (!HASH.safeParse(hash2).success) throw new CommandError("Invalid code blob SHA256; no source was uploaded.");
+    await this.request("PUT", `/blobs/${hash2}`, bytes);
+  }
+  async getSync(viewId, syncId) {
+    return decode(syncStatus, (await this.request(
+      "GET",
+      `/views/${encodeURIComponent(viewId)}/syncs/${encodeURIComponent(syncId)}`
+    )).data);
+  }
+  async activate(viewId, syncId) {
+    return decode(
+      activated,
+      (await this.request(
+        "POST",
+        `/views/${encodeURIComponent(viewId)}/syncs/${encodeURIComponent(syncId)}/activate`,
+        {}
+      )).data
+    );
   }
-  const stored = readCredentials(path);
-  const superseded = stored !== null && stored.token !== token ? stored : null;
+};
+
+// src/core/code/sync.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { setTimeout as delay2 } from "timers/promises";
+
+// src/core/code/git.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { realpath } from "fs/promises";
+var run2 = promisify(execFile);
+var MAX_GIT_BYTES = 16 * 1024 * 1024;
+async function gitBytes(cwd, args, maxBuffer = MAX_GIT_BYTES, limitMessage = "Git returned more than 16 MiB of metadata; this exceeds the code-sync client limit.") {
   try {
-    writeCredentials(path, baseUrl, token);
+    return (await run2(
+      "git",
+      [
+        "--no-optional-locks",
+        "--no-pager",
+        "-c",
+        "core.fsmonitor=false",
+        ...args
+      ],
+      { cwd, maxBuffer, timeout: 3e4, encoding: "buffer" }
+    )).stdout;
   } catch (error) {
-    if (received.minted) await revokeSession(client, token);
-    const detail = error instanceof Error ? error.message : String(error);
-    return {
-      ok: false,
-      message: `could not store credentials at ${path}: ${detail}` + (expert ? " (the pxc_ credential is still valid: revoke it in your expert view)" : received.minted ? "" : " (the pasted token was not revoked and stays valid)")
-    };
+    const code2 = error.code;
+    if (code2 === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" || error instanceof Error && /maxBuffer/i.test(error.message))
+      throw new LocalError(
+        limitMessage
+      );
+    throw new LocalError(
+      "Cannot read this Git working tree. Run code commands inside a committed repository with an origin remote."
+    );
   }
-  let supersededNote = "";
-  if (superseded !== null) {
-    await revokeSession(bareClient(superseded.url, superseded.token, options), superseded.token);
-    if (isExpertToken(superseded.token)) {
-      supersededNote = "The pxc_ credential stored before stays valid until it expires: revoke it in your expert view.\n";
+}
+function decodeUtf8(value, message) {
+  const decoded = value.toString("utf8");
+  if (!Buffer.from(decoded, "utf8").equals(value)) throw new LocalError(message);
+  return decoded;
+}
+function decodeGitPaths(outputs) {
+  const paths = [];
+  for (const output of outputs) {
+    if (output.length > 0 && output.at(-1) !== 0)
+      throw new LocalError("Code sync received an incomplete Git path record.");
+    let start = 0;
+    for (let end = output.indexOf(0, start); end !== -1; end = output.indexOf(0, start)) {
+      if (end === start)
+        throw new LocalError("Code sync received an empty Git path record.");
+      const path = decodeUtf8(
+        output.subarray(start, end),
+        "Code sync cannot safely index a Git path with invalid UTF-8."
+      );
+      if (/[\x00-\x1f\x7f-\x9f]/.test(path))
+        throw new LocalError(
+          "Code sync cannot safely index a Git path with control characters."
+        );
+      paths.push(path);
+      start = end + 1;
     }
   }
-  const name = invokedName();
-  return {
-    ok: true,
-    json: { url: baseUrl, credentials: path, kind },
-    human: (expert ? `Stored an outside expert's pxc_ credential for ${baseUrl} at ${path} (it lasts at most 30 days; revoke it in your expert view \u2014 ${name} logout only forgets it). Commands now act as the expert: only assignments, conditions and gate work until you log in again.
-` : `Logged in to ${baseUrl} \u2014 login token stored at ${path} (valid ~30 days; ${name} logout revokes it).
-`) + kindNote(kind) + supersededNote
-  };
-}
-function kindNote(kind) {
-  if (kind === "operator-cli") {
-    return "This credential is Operator-only (operator-cli): Operator commands work; issue, plan and gate commands are refused.\n";
+  return paths;
+}
+function decodeGitLine(output, message) {
+  if (output.length === 0 || output.at(-1) !== 10)
+    throw new LocalError(message);
+  return decodeUtf8(output.subarray(0, -1), message);
+}
+function assertDistinctPathIdentities(paths) {
+  const known = /* @__PURE__ */ new Map();
+  for (const path of paths) {
+    let original = "";
+    let folded = "";
+    for (const part of path.split("/")) {
+      original += `/${part}`;
+      folded += `/${part.normalize("NFC").toLocaleLowerCase("en-US").toLocaleUpperCase("en-US").normalize("NFC")}`;
+      const previous = known.get(folded);
+      if (previous !== void 0 && previous !== original)
+        throw new LocalError(
+          "Code sync cannot safely distinguish colliding Git path identities."
+        );
+      known.set(folded, original);
+    }
   }
-  if (kind === "harness-cli") return "This credential has full access (harness-cli).\n";
-  return "";
 }
-async function describeSession(client) {
+async function identity(cwd) {
+  const rootRecord = decodeGitLine(
+    await gitBytes(cwd, ["rev-parse", "--show-toplevel"]),
+    "Cannot resolve the Git working tree root safely."
+  );
+  if (/[\x00-\x1f\x7f-\x9f]/.test(rootRecord))
+    throw new LocalError("Cannot resolve the Git working tree root safely.");
+  const root = await realpath(rootRecord);
+  const commit = decodeGitLine(
+    await gitBytes(root, ["rev-parse", "--verify", "HEAD^{commit}"]),
+    "Cannot resolve the repository HEAD commit."
+  );
+  const missingRemote = "repository_not_connected: code indexing requires an origin on github.com shared through your organization\u2019s Harness GitHub connection.";
+  let remote;
   try {
-    const { envelope, apiVersion } = await client.getVersioned(SESSION_PATH);
-    return { session: sessionOf(envelope.data), apiVersion };
-  } catch (error) {
-    if (error instanceof HttpError && (error.status === 404 || error.status === 405)) return null;
-    throw error;
+    remote = decodeGitLine(await gitBytes(root, ["remote", "get-url", "origin"]), missingRemote);
+  } catch {
+    throw new LocalError(missingRemote);
   }
-}
-function sessionOf(data) {
-  if (!isRecord3(data)) return NO_SESSION;
-  const text = (value) => typeof value === "string" ? value : null;
+  if (/[\x00-\x1f\x7f-\x9f]/.test(remote))
+    throw new LocalError(
+      "repository_not_connected: code indexing requires an origin on github.com shared through your organization\u2019s Harness GitHub connection."
+    );
+  const scp = /^(?:git@)?github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/i.exec(remote);
+  let parts;
+  if (scp) parts = [scp[1], scp[2]];
+  else {
+    try {
+      const url = new URL(remote);
+      if (["https:", "ssh:", "git:"].includes(url.protocol) && url.hostname.toLowerCase() === "github.com" && !url.password && !url.search && !url.hash && (!url.port || url.protocol === "ssh:")) {
+        parts = url.pathname.replace(/^\//, "").replace(/\/$/, "").replace(/\.git$/, "").split("/");
+      }
+    } catch {
+    }
+  }
+  if (!parts || parts.length !== 2 || parts.some((p) => !p || !/^[\w.-]+$/.test(p) || p === "." || p === ".."))
+    throw new LocalError(
+      "repository_not_connected: code indexing requires an origin on github.com shared through your organization\u2019s Harness GitHub connection."
+    );
+  if (!/^[0-9a-f]{40,64}$/.test(commit))
+    throw new LocalError("Cannot resolve the repository HEAD commit.");
   return {
-    kind: text(data["kind"]),
-    expires_at: text(data["expires_at"]),
-    scopes: Array.isArray(data["scopes"]) ? data["scopes"].filter((scope) => typeof scope === "string") : null,
-    user: isRecord3(data["user"]) ? data["user"] : null,
-    org: isRecord3(data["org"]) ? data["org"] : null
+    root,
+    commit,
+    repoKey: `github.com/${parts.join("/").toLowerCase()}`
   };
 }
-async function revokeSession(client, token) {
-  if (isExpertToken(token)) return false;
-  return client.delete("/api/v1/session").then(() => true).catch(() => false);
+async function changedPaths(root, commit) {
+  const changed = await gitBytes(root, [
+    "diff",
+    "--name-only",
+    "-z",
+    "--no-renames",
+    "--no-ext-diff",
+    "--no-textconv",
+    commit,
+    "--"
+  ]);
+  const untracked = await gitBytes(root, [
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "-z"
+  ]);
+  return [
+    ...new Set(decodeGitPaths([changed, untracked]))
+  ].sort(
+    (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b))
+  );
 }
-async function logout(options = {}) {
-  const path = options.credentialsPath ?? defaultCredentialsPath(options.env ?? process.env);
-  const stored = readCredentials(path);
-  if (stored === null) {
-    const envToken = (options.env ?? process.env)["HARNESS_API_TOKEN"] ?? "";
-    return {
-      ok: false,
-      message: "No stored login to remove. A HARNESS_API_TOKEN from the environment is yours to manage \u2014 " + (isExpertToken(envToken.trim()) ? "unset it, or revoke the pxc_ credential in your expert view." : "unset it, or disable the token in the admin UI.")
-    };
+function decodeGitTree(output) {
+  if (output.length && output.at(-1) !== 0)
+    throw new LocalError("Code sync received incomplete Git tree metadata.");
+  const entries = [];
+  for (let start = 0, end = output.indexOf(0); end !== -1; end = output.indexOf(0, start)) {
+    const record2 = output.subarray(start, end), tab = record2.indexOf(9);
+    if (tab < 0) throw new LocalError("Code sync received invalid Git tree metadata.");
+    const header = decodeUtf8(record2.subarray(0, tab), "Code sync received invalid Git tree metadata.");
+    const match = /^(100644|100755|120000|160000) (blob|commit) ([0-9a-f]{40}|[0-9a-f]{64})$/.exec(header);
+    if (!match || match[1] === "160000" !== (match[2] === "commit"))
+      throw new LocalError("Code sync received invalid Git tree metadata.");
+    const [path] = decodeGitPaths([Buffer.concat([record2.subarray(tab + 1), Buffer.from([0])])]);
+    entries.push({ path, regular: match[1] === "100644" || match[1] === "100755" });
+    start = end + 1;
+  }
+  return entries;
+}
+
+// src/core/code/scan.ts
+import { constants as constants2 } from "fs";
+import { open } from "fs/promises";
+import { join } from "path";
+import { createHash } from "crypto";
+import { release } from "os";
+
+// src/core/code/policy.ts
+import { isUtf8 } from "buffer";
+import { extname } from "path";
+
+// src/core/code/glob.ts
+var MAX_PATTERN_BYTES = 256;
+var MAX_PATTERN_STARS = 8;
+var MAX_PATTERNS = 1e3;
+function trimIgnoreLine(line) {
+  return line.replace(new RegExp("^\\p{White_Space}+|\\p{White_Space}+$", "gu"), "");
+}
+function compileIgnorePatterns(lines, warnings) {
+  const patterns = [];
+  for (const [line, raw] of lines.entries()) {
+    const trimmed = trimIgnoreLine(raw);
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    if (trimmed.startsWith("!")) {
+      warnings.push(
+        `Ignoring .harnesscodeignore negation on line ${line + 1}; code-index patterns do not support !.`
+      );
+      continue;
+    }
+    if (trimmed.includes("\\")) {
+      warnings.push(
+        `The .harnesscodeignore backslash on line ${line + 1} is literal and never matches a normalized source path.`
+      );
+    }
+    if (Buffer.byteLength(trimmed) > MAX_PATTERN_BYTES || (trimmed.match(/\*/g)?.length ?? 0) > MAX_PATTERN_STARS) {
+      warnings.push(
+        "Ignoring .harnesscodeignore pattern outside the code-index size limits."
+      );
+      continue;
+    }
+    if (patterns.length === MAX_PATTERNS) {
+      warnings.push(
+        "Ignoring .harnesscodeignore patterns after the first 1,000 valid entries."
+      );
+      break;
+    }
+    const pattern = compilePattern(trimmed);
+    if (pattern) patterns.push(pattern);
+  }
+  return Object.freeze(patterns);
+}
+function patternLimitError() {
+  return new Error("Code upload policy contains an invalid path pattern.");
+}
+function tokens(glob) {
+  const result = [];
+  for (const [i, part] of glob.split("**/").entries()) {
+    if (i) result.push("optDirs");
+    for (const [j, piece] of part.split("/**").entries()) {
+      if (j) result.push(47, "starAny");
+      for (const byte of Buffer.from(piece)) {
+        const token = byte === 42 ? "starSeg" : byte === 63 ? "anySeg" : byte;
+        if (token !== "starSeg" || result.at(-1) !== token) result.push(token);
+      }
+    }
   }
-  const expert = isExpertToken(stored.token);
-  const revoked = await revokeSession(bareClient(stored.url, stored.token, options), stored.token);
-  const note = revoked ? "" : " (server-side revoke failed \u2014 the token still expires on its own)";
-  try {
-    deleteCredentials(path);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return {
-      ok: false,
-      message: `could not remove ${path} (${detail}) \u2014 delete it manually.` + (revoked ? " The token itself was revoked." : "")
+  return result;
+}
+function mask(indices) {
+  const top = indices.at(-1);
+  const bytes = Buffer.alloc((top >> 3) + 1);
+  for (const bit of indices) bytes[bytes.length - 1 - (bit >> 3)] |= 1 << (bit & 7);
+  return BigInt("0x" + bytes.toString("hex"));
+}
+var ByteGlob = class {
+  constructor(specs) {
+    this.specs = specs;
+    const positions = /* @__PURE__ */ new Map();
+    const add = (key, index) => {
+      const values = positions.get(key);
+      if (values) values.push(index);
+      else positions.set(key, [index]);
     };
-  }
-  return {
-    ok: true,
-    json: { logged_out: true, revoked },
-    human: expert ? `Forgot the outside expert's pxc_ credential for ${stored.url}. It stays valid until it expires: revoke it in your expert view to end it now.
-` : `Logged out of ${stored.url}${note}.
-`
-  };
-}
-async function whoami(config, credentialSource) {
-  const client = new Client(config);
-  const expert = isExpertToken(config.token);
-  let probe;
-  let session = null;
-  let serverVersion;
-  try {
-    const described2 = isLoginCredential(config.token) ? await describeSession(client) : null;
-    if (described2 !== null) {
-      session = described2.session;
-      serverVersion = described2.apiVersion;
-    } else {
-      const answered = await client.getVersioned(expert ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats");
-      probe = answered.envelope.data;
-      serverVersion = answered.apiVersion;
+    let base2 = 0;
+    for (const [index, spec] of specs.entries()) {
+      const sequence = [...spec.anchored ? [] : ["optPrefix"], ...tokens(spec.glob), ...spec.descendants ? ["optTail"] : []];
+      add("start", base2);
+      add("finals", base2 + sequence.length);
+      this.finalIndices.set(base2 + sequence.length, index);
+      for (const [offset, token] of sequence.entries()) {
+        const bit = base2 + offset;
+        add(token, bit);
+        if (typeof token === "number") {
+          if (spec.fold && (token >= 65 && token <= 90 || token >= 97 && token <= 122)) add(token ^ 32, bit);
+        } else if (token !== "anySeg") add("eps", bit);
+      }
+      base2 += sequence.length + 1;
     }
-  } catch (error) {
-    if (error instanceof HttpError) {
-      return {
-        ok: false,
-        message: expert ? `signed in to ${config.baseUrl} with an outside expert's pxc_ credential (${credentialSource}), but it was refused: ${error.message} (HTTP ${error.status})${error.status === 401 ? ` \u2014 ${EXPERT_LAPSED}` : ""}` : `signed in to ${config.baseUrl} with a ${credentialSource} credential, but it failed verification: ${error.message} (HTTP ${error.status})`
-      };
+    const masks = new Map([...positions].map(([key, bits]) => [key, mask(bits)]));
+    for (const [key, value] of masks) if (typeof key === "number") this.literals.set(key, value);
+    const get = (key) => masks.get(key) ?? 0n;
+    this.start = get("start");
+    this.finals = get("finals");
+    this.anySeg = get("anySeg");
+    this.starSeg = get("starSeg");
+    this.starAny = get("starAny");
+    this.eps = get("eps");
+    this.optDirs = get("optDirs");
+    this.optPrefix = get("optPrefix");
+    this.optTail = get("optTail");
+  }
+  specs;
+  start;
+  finals;
+  literals = /* @__PURE__ */ new Map();
+  anySeg;
+  starSeg;
+  starAny;
+  eps;
+  optDirs;
+  optPrefix;
+  optTail;
+  finalIndices = /* @__PURE__ */ new Map();
+  close(states, inner) {
+    for (; ; ) {
+      inner |= states & (this.optDirs | this.optPrefix);
+      const closed = states | (states & this.eps) << 1n | (inner & this.optTail) << 1n;
+      if (closed === states) return [states, inner];
+      states = closed;
     }
-    throw error;
   }
-  let seat = null;
-  if (expert) {
-    seat = expertSeat(probe);
-    if (seat === null) {
-      return {
-        ok: false,
-        message: `signed in to ${config.baseUrl} with an outside expert's pxc_ credential, but the assignments response carried no expert`
-      };
+  step(byte, states, inner) {
+    const advance = (this.literals.get(byte) ?? 0n) | (byte === 47 ? 0n : this.anySeg);
+    const stay = (byte === 47 ? 0n : this.starSeg) | (byte === 10 ? 0n : this.starAny);
+    let next = (states & advance) << 1n | states & stay;
+    let nextInner = byte === 10 ? inner & this.optPrefix : inner;
+    if (byte === 47) {
+      next |= (inner & (this.optDirs | this.optPrefix)) << 1n;
+      nextInner |= states & this.optTail;
+    }
+    return this.close(next, nextInner);
+  }
+  /** Highest matching pattern preserves matchingPattern's last-match result. */
+  matchedIndex(path) {
+    if (!this.start) return null;
+    let [states, inner] = this.close(this.start, 0n);
+    const bytes = Buffer.from(path);
+    let beforeFinalNewline = 0n;
+    for (let i = 0; i < bytes.length; i++) {
+      if (i === bytes.length - 1 && bytes[i] === 10) beforeFinalNewline = states;
+      [states, inner] = this.step(bytes[i], states, inner);
+      if (!states && !inner && !beforeFinalNewline) return null;
     }
+    const final = (states | beforeFinalNewline) & this.finals;
+    if (!final) return null;
+    const hex = final.toString(16);
+    const highest = (hex.length - 1) * 4 + Math.floor(Math.log2(parseInt(hex[0], 16)));
+    return this.finalIndices.get(highest) ?? null;
   }
-  serverVersion ??= "unknown";
-  const hostSourceLabels = {
-    env: "HARNESS_API_URL",
-    "repo-config": ".harness-cli/config.json",
-    "stored-login": "stored login",
-    default: "workspace default"
-  };
-  const via = config.hostSource !== void 0 ? ` (via ${hostSourceLabels[config.hostSource]})` : "";
-  const expertLines = seat === null ? "" : `Expert:      ${expertSummary(seat)}
-Reaches:     its own assignments and the gates it owns on them (assignments, conditions, gate)
-`;
-  const described = session ?? NO_SESSION;
-  return {
-    ok: true,
-    json: {
-      url: config.baseUrl,
-      source: credentialSource,
-      verified: true,
-      server_version: serverVersion,
-      host_source: config.hostSource,
-      kind: described.kind,
-      expires_at: described.expires_at,
-      scopes: described.scopes,
-      user: described.user,
-      org: described.org,
-      expert: seat
-    },
-    human: `Host:        ${config.baseUrl}${via}
-Credential:  ${credentialSource}${seat === null ? "" : ", an outside expert's pxc_ credential"}${kindLabel(described.kind)}
-` + sessionLines(described) + expertLines + `Verified:    ok (server API ${serverVersion})
-`
-  };
-}
-function kindLabel(kind) {
-  if (kind === null) return "";
-  if (kind === "harness-cli") return ", harness-cli (full access)";
-  if (kind === "operator-cli") return ", operator-cli (Operator only)";
-  return `, ${clean(kind)}`;
-}
-function sessionLines(session) {
-  let lines = "";
-  const user2 = session.user;
-  if (user2 !== null) {
-    const name = clean(user2["name"]);
-    const email = clean(user2["email"]);
-    lines += `User:        ${name === "" ? email : email === "" ? name : `${name} <${email}>`}
-`;
+  test(path) {
+    return this.matchedIndex(path) !== null;
   }
-  const org = session.org;
-  if (org !== null) {
-    const name = clean(org["name"]);
-    const slug = clean(org["slug"]);
-    lines += `Org:         ${slug === "" || slug === name ? name : `${name} (${slug})`}
-`;
+};
+function compilePattern(raw, {
+  caseInsensitive = false,
+  mode = "ignore",
+  warnings,
+  maxPatternBytes = MAX_PATTERN_BYTES,
+  maxStars = MAX_PATTERN_STARS,
+  rejectUnsupported = false
+} = {}) {
+  let pattern = mode === "served" ? raw : trimIgnoreLine(raw);
+  if (pattern === "") return null;
+  if (pattern.startsWith("#")) {
+    if (rejectUnsupported) throw patternLimitError();
+    return null;
   }
-  if (session.expires_at !== null) lines += `Expires:     ${clean(session.expires_at)}
-`;
-  if (session.kind === "operator-cli") {
-    lines += "Reaches:     Operator commands only; issue, plan and gate commands are refused\n";
+  if (Buffer.byteLength(pattern) > maxPatternBytes || (pattern.match(/\*/g)?.length ?? 0) > maxStars)
+    throw patternLimitError();
+  if (pattern.startsWith("!")) {
+    if (rejectUnsupported) throw patternLimitError();
+    warnings?.push(
+      "Ignoring .harnesscodeignore negation; code-index patterns do not support !."
+    );
+    return null;
   }
-  return lines;
-}
-function expertSeat(data) {
-  if (!isRecord3(data) || !isRecord3(data["expert"])) return null;
-  const plan2 = isRecord3(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
-  const steps = Array.isArray(data["assignments"]) ? data["assignments"].filter(isRecord3).length : 0;
-  return { id: data["expert"]["id"], role: data["expert"]["role"] ?? null, plan: plan2, assigned_steps: steps };
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function bareClient(baseUrl, token, options) {
-  const config = {
-    baseUrl: baseUrl.replace(/\/+$/, ""),
-    token,
-    actor: null,
-    team: null,
-    cacheDir: ""
-  };
-  if (options.fetchImpl !== void 0) config.fetchImpl = options.fetchImpl;
-  return new Client(config);
-}
-function defaultNotify(line) {
-  process.stderr.write(named(line + "\n"));
-}
-function defaultPrompt() {
-  const readline = createInterface({
-    input: process.stdin,
-    output: process.stderr
-  });
-  return new Promise((resolve) => {
-    readline.question("Token: ", (answer) => {
-      readline.close();
-      resolve(answer);
-    });
+  if (pattern.includes("\\")) {
+    if (rejectUnsupported) throw patternLimitError();
+    warnings?.push(
+      "A .harnesscodeignore backslash is literal, not an escape."
+    );
+  }
+  if (rejectUnsupported && /[\[\]{}]/.test(pattern)) throw patternLimitError();
+  const rooted = pattern.startsWith("/");
+  if (mode === "ignore") pattern = pattern.replace(/^\/+|\/+$/g, "");
+  const anchored = rooted || pattern.includes("/");
+  return Object.freeze({
+    source: mode === "served" ? raw : trimIgnoreLine(raw),
+    negated: false,
+    matcher: new ByteGlob([{ glob: pattern, anchored, descendants: mode === "ignore", fold: caseInsensitive }])
   });
 }
-function defaultOpenBrowser(url) {
-  const opener = browserOpener();
-  if (opener !== null) {
-    execFile(opener, [url], () => void 0);
-  }
+function compilePatterns(lines, options = {}) {
+  const maxPatterns = options.maxPatterns ?? MAX_PATTERNS;
+  if (lines.length > maxPatterns) throw patternLimitError();
+  return Object.freeze(lines.map((line) => compilePattern(line, options)).filter((pattern) => pattern !== null));
 }
-
-// src/core/stdio.ts
-var BROKEN_PIPE_CODES = /* @__PURE__ */ new Set(["EPIPE", "ERR_STREAM_DESTROYED"]);
-function guardBrokenPipes(streams = [process.stdout, process.stderr]) {
-  for (const stream of streams) {
-    stream.on("error", (error) => {
-      if (!BROKEN_PIPE_CODES.has(error.code ?? "")) throw error;
-    });
+var matcherCache = /* @__PURE__ */ new WeakMap();
+function matchingPattern(path, patterns) {
+  if (!patterns.length) return null;
+  let matcher = matcherCache.get(patterns);
+  if (!matcher) {
+    matcher = new ByteGlob(patterns.flatMap((pattern) => [...pattern.matcher.specs]));
+    if (Object.isFrozen(patterns)) matcherCache.set(patterns, matcher);
   }
+  const index = matcher.matchedIndex(path);
+  return index === null ? null : patterns[index];
 }
 
-// src/core/upgrade.ts
-import { spawn as spawn2, spawnSync } from "child_process";
-import {
-  accessSync as accessSync2,
-  constants as constants2,
-  existsSync,
-  linkSync,
-  mkdirSync,
-  readFileSync,
-  realpathSync,
-  renameSync,
-  rmSync,
-  statSync,
-  writeFileSync
-} from "fs";
-import { basename, dirname, join as join2, parse, sep } from "path";
-import { fileURLToPath } from "url";
-var PACKAGE_NAME = "@allocator-one/harness-cli";
-var PACKAGE_NAMES = [PACKAGE_NAME, OPERATOR_PACKAGE];
-var UPGRADE_INSTALL_SPEC = `${PACKAGE_NAME}@latest`;
-function upgradeInstallSpec(install) {
-  return `${install.packageName ?? PACKAGE_NAME}@latest`;
-}
-var UPDATE_CHECK_COMMAND = "__update-check";
-var REEXEC_SENTINEL = "HARNESS_UPGRADED";
-function latestUrl(packageName = PACKAGE_NAME) {
-  return `https://registry.npmjs.org/${packageName}/latest`;
-}
-var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var REGISTRY_TIMEOUT_MS = 5e3;
-var NPM_ROOT_TIMEOUT_MS = 15e3;
-var INSTALL_TIMEOUT_MS = 12e4;
-var LOCK_STALE_MS = NPM_ROOT_TIMEOUT_MS + INSTALL_TIMEOUT_MS + 6e4;
-function detectInstall(from = fileURLToPath(import.meta.url)) {
-  const unknown = {
-    kind: "unknown",
-    packageRoot: null,
-    nodeModules: null
+// src/core/code/policy.ts
+var MAX_FILE_BYTES = 1048576;
+var EXTENSIONS = [
+  ".ex",
+  ".exs",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".jsx",
+  ".ts",
+  ".tsx",
+  ".swift"
+];
+var DENY = [
+  ".env",
+  ".env.*",
+  "secrets/**",
+  "**/secrets/**",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.pfx",
+  "*.jks",
+  "*.keystore",
+  "id_rsa*",
+  "id_ecdsa*",
+  "id_ed25519*",
+  "*.kdbx",
+  ".npmrc",
+  ".netrc",
+  "credentials.json",
+  "**/.aws/**",
+  ".git/**",
+  "node_modules/**",
+  "_build/**",
+  "deps/**",
+  "dist/**",
+  "*.lock",
+  "package-lock.json",
+  "*.min.js",
+  "*.map",
+  "priv/static/**",
+  "src/generated/**",
+  "DerivedData/**",
+  "**/DerivedData/**",
+  ".build/**",
+  "**/.build/**",
+  "Pods/**",
+  "Carthage/Build/**",
+  "xcuserdata/**",
+  "**/xcuserdata/**",
+  "*.xcuserstate",
+  "*.xcresult/**",
+  "*.xcarchive/**",
+  "*.dSYM/**",
+  "*.ipa",
+  "*.secret.exs"
+];
+var SECRET_PATTERN_SOURCES = [
+  "-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----",
+  "\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b",
+  "\\baone_[A-Za-z0-9_-]{20,}",
+  "\\bgh[opsur]_[A-Za-z0-9]{36}\\b",
+  "\\b[rs]k_live_[A-Za-z0-9]{20,}",
+  "\\bAIza[0-9A-Za-z_-]{35}\\b",
+  "\\bxapp-\\d-[A-Za-z0-9-]{20,}",
+  "hooks\\.slack\\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+",
+  "\\bgithub_pat_[A-Za-z0-9_]{22,}",
+  "\\bxox[baprs]-\\d{8,}-[A-Za-z0-9-]{10,}",
+  "\\bsk-(?:proj-|ant-[a-z0-9]+-)?[A-Za-z0-9_-]{32,}"
+];
+var SECRETS = SECRET_PATTERN_SOURCES.map((source) => new RegExp(source));
+function contentMatchers(patterns) {
+  const literalMarkers = [];
+  for (const pattern of patterns) {
+    if (SECRET_PATTERN_SOURCES.includes(pattern)) continue;
+    if (!pattern || /[\\^$.*+?()[\]{}|]/.test(pattern))
+      throw new Error("unknown regular expression");
+    literalMarkers.push(pattern);
+  }
+  return literalMarkers;
+}
+function servedCase(served) {
+  const value = served.deny_glob_case;
+  if (value !== void 0 && value !== "ascii_insensitive")
+    throw new Error("unknown deny glob case mode");
+  return value;
+}
+function buildPolicy(served, ignore, includeFloor) {
+  const warnings = [];
+  const unsupported = [...new Set(
+    served.include_extensions.filter((extension) => !EXTENSIONS.includes(extension))
+  )].sort();
+  if (unsupported.length)
+    warnings.push(
+      `This harness-cli does not send ${unsupported.join(", ")} files; upgrade the client.`
+    );
+  const insensitiveServed = servedCase(served) === "ascii_insensitive";
+  const literalMarkers = contentMatchers(served.content_patterns);
+  return {
+    limit: Math.min(served.max_file_bytes, MAX_FILE_BYTES),
+    deny: Object.freeze([
+      ...includeFloor ? compilePatterns(DENY, {
+        caseInsensitive: true,
+        maxPatterns: Infinity,
+        maxPatternBytes: Infinity,
+        maxStars: Infinity
+      }) : [],
+      ...compilePatterns(served.deny_globs, {
+        caseInsensitive: includeFloor || insensitiveServed,
+        mode: "served",
+        maxPatternBytes: 1024,
+        maxStars: Infinity,
+        rejectUnsupported: true
+      })
+    ]),
+    ignore: compileIgnorePatterns(ignore.split(/\r?\n/), warnings),
+    patterns: SECRETS,
+    literalMarkers,
+    extensions: new Set(
+      EXTENSIONS.filter((extension) => served.include_extensions.includes(extension))
+    ),
+    warnings
   };
-  if (from.split(sep).includes("_npx")) return { ...unknown, kind: "npx" };
-  const found = findPackageRoot(from);
-  if (found === null) return unknown;
-  const { packageRoot, packageName } = found;
-  if (existsSync(join2(packageRoot, ".git"))) {
-    return { kind: "checkout", packageRoot, packageName, nodeModules: null };
-  }
-  const nodeModules = enclosingNodeModules(packageRoot);
-  if (nodeModules === null) return { ...unknown, packageRoot, packageName };
-  const kind = existsSync(join2(nodeModules, ".bin")) ? "local" : "global";
-  return { kind, packageRoot, packageName, nodeModules };
-}
-function findPackageRoot(from) {
-  let dir = dirname(from);
-  const { root } = parse(dir);
-  for (; ; ) {
-    const name = packageNameAt(join2(dir, "package.json"));
-    if (name !== null && PACKAGE_NAMES.includes(name))
-      return { packageRoot: dir, packageName: name };
-    if (dir === root) return null;
-    dir = dirname(dir);
-  }
-}
-function packageNameAt(path) {
+}
+function policyFor(served, ignore) {
   try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const name = parsed["name"];
-    return typeof name === "string" ? name : null;
+    return buildPolicy(served, ignore, true);
   } catch {
-    return null;
+    throw new CommandError(
+      "The server returned an invalid code upload policy; upgrade the client before code sync."
+    );
   }
 }
-function versionAt(packageRoot) {
+function basePolicyFor(served, ignore) {
   try {
-    const parsed = JSON.parse(
-      readFileSync(join2(packageRoot, "package.json"), "utf8")
-    );
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const version2 = parsed["version"];
-    return typeof version2 === "string" ? version2 : null;
+    return buildPolicy(served, ignore, false);
   } catch {
-    return null;
+    throw new CommandError(
+      "The server returned an invalid code upload policy; upgrade the client before code sync."
+    );
   }
 }
-function enclosingNodeModules(packageRoot) {
-  let dir = dirname(packageRoot);
-  const { root } = parse(dir);
-  for (; ; ) {
-    if (basename(dir) === "node_modules") return dir;
-    if (dir === root) return null;
-    dir = dirname(dir);
-  }
+function pathReason(path, p) {
+  if (!path || Buffer.byteLength(path) > 1024 || /[\\\x00-\x1f\x7f-\x9f]/.test(path) || Buffer.from(path, "utf8").toString("utf8") !== path || path.split("/").some((segment) => ["", ".", ".."].includes(segment)))
+    return "invalid_path";
+  if (matchingPattern(path, p.deny)) return "excluded_path";
+  if (matchingPattern(path, p.ignore)) return "ignored";
+  return p.extensions.has(extname(path)) ? null : "unsupported_language";
 }
-var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
-function parseVersion(value) {
-  const match = SEMVER.exec(value.trim());
-  if (match === null) return null;
-  return {
-    parts: [Number(match[1]), Number(match[2]), Number(match[3])],
-    pre: match[4] ?? null
-  };
+function extensionWarning(path, p) {
+  const extension = extname(path);
+  return !p.extensions.has(extension) && p.extensions.has(extension.toLowerCase()) ? `The server indexes ${extension.toLowerCase()} exactly; ${path} was skipped.` : null;
 }
-function isNewer(candidate, current) {
-  const a = parseVersion(candidate);
-  const b = parseVersion(current);
-  if (a === null || b === null) return false;
-  for (let index = 0; index < 3; index++) {
-    if (a.parts[index] !== b.parts[index])
-      return a.parts[index] > b.parts[index];
-  }
-  if (a.pre === b.pre) return false;
-  if (a.pre === null) return true;
-  if (b.pre === null) return false;
-  return comparePrerelease(a.pre, b.pre) > 0;
-}
-function comparePrerelease(left, right) {
-  const a = left.split(".");
-  const b = right.split(".");
-  for (let index = 0; index < Math.max(a.length, b.length); index++) {
-    const x = a[index];
-    const y = b[index];
-    if (x === void 0) return -1;
-    if (y === void 0) return 1;
-    const xNumeric = /^\d+$/.test(x);
-    const yNumeric = /^\d+$/.test(y);
-    if (xNumeric && yNumeric) {
-      if (Number(x) !== Number(y)) return Number(x) < Number(y) ? -1 : 1;
-    } else if (xNumeric !== yNumeric) {
-      return xNumeric ? -1 : 1;
-    } else if (x !== y) {
-      return x < y ? -1 : 1;
-    }
-  }
-  return 0;
+function contentReason(bytes, p) {
+  if (bytes.length > p.limit) return "too_large";
+  if (bytes.includes(0) || !isUtf8(bytes)) return "binary";
+  const text = bytes.toString("utf8");
+  return p.patterns.some((pattern) => pattern.test(text)) || p.literalMarkers.some((marker) => text.includes(marker)) ? "secret_content" : null;
 }
-function stampPath(env = process.env, packageName = PACKAGE_NAME) {
-  const file = packageName === PACKAGE_NAME ? "update-check.json" : `update-check-${packageName.replace(/^@[^/]+\//, "")}.json`;
-  return join2(resolveCacheHome(env), "harness", file);
+
+// src/core/code/scan.ts
+var MAX_OVERLAY_BYTES = 64 * 1024 * 1024;
+var MAX_OVERLAY_CHANGES = 2e4;
+var O_NOFOLLOW_ANY = 536870912;
+function sha256(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+function supportsDarwinNoFollowAny(osRelease = release()) {
+  const major = Number(osRelease.split(".")[0]);
+  return Number.isInteger(major) && major >= 20;
+}
+async function committedIgnore(root, commit) {
+  const entry = decodeUtf8(
+    await gitBytes(root, [
+      "ls-tree",
+      "-z",
+      commit,
+      "--",
+      ".harnesscodeignore"
+    ]),
+    "Cannot read the committed .harnesscodeignore safely."
+  );
+  if (!entry) return "";
+  const match = /^(\d+) blob ([0-9a-f]+)\t\.harnesscodeignore\0$/.exec(entry);
+  if (!match || !["100644", "100755"].includes(match[1]))
+    throw new LocalError(
+      "The committed .harnesscodeignore must be a regular file before code sync."
+    );
+  return decodeUtf8(
+    await gitBytes(root, ["cat-file", "blob", match[2]], 65537, "The committed .harnesscodeignore exceeds 64 KiB; reduce it before code sync."),
+    "The committed .harnesscodeignore must be valid UTF-8 before code sync."
+  );
 }
-function readStamp(env = process.env, packageName = PACKAGE_NAME) {
+var directoryFlags = constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK;
+async function openLinuxRoot(root) {
+  let handle;
   try {
-    const parsed = JSON.parse(
-      readFileSync(stampPath(env, packageName), "utf8")
-    );
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const record = parsed;
-    const checkedAt = record["checkedAt"];
-    if (typeof checkedAt !== "number" || !Number.isFinite(checkedAt))
-      return null;
-    const latest = record["latest"];
-    return { checkedAt, latest: typeof latest === "string" ? latest : null };
+    if (!root.startsWith("/"))
+      throw new Error("repository root is not absolute");
+    handle = await open("/", directoryFlags);
+    for (const part of root.split("/").filter(Boolean)) {
+      if (part === "." || part === "..")
+        throw new Error("repository root is invalid");
+      const next = await open(
+        `/proc/self/fd/${handle.fd}/${part}`,
+        directoryFlags
+      );
+      await handle.close();
+      handle = next;
+    }
+    return handle;
   } catch {
-    return null;
+    await handle?.close().catch(() => {
+    });
+    throw new LocalError(
+      "Code sync cannot establish a safe source root on this platform."
+    );
   }
 }
-function writeStamp(stamp, env = process.env, packageName = PACKAGE_NAME) {
-  const path = stampPath(env, packageName);
-  const temporary = `${path}.${process.pid}.tmp`;
-  const latest = stamp.latest ?? readStamp(env, packageName)?.latest ?? null;
+async function openLinuxBelowRoot(root, path) {
+  let handle = await openLinuxRoot(root);
   try {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(temporary, JSON.stringify({ ...stamp, latest }) + "\n");
-    renameSync(temporary, path);
-  } catch {
-    try {
-      rmSync(temporary, { force: true });
-    } catch {
+    const parts = path.split("/");
+    for (const [index, part] of parts.entries()) {
+      if (!part || part === "." || part === "..")
+        throw new LocalError(
+          "Cannot read an overlay file safely; invalid path."
+        );
+      const next = await open(
+        `/proc/self/fd/${handle.fd}/${part}`,
+        constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK | (index === parts.length - 1 ? 0 : constants2.O_DIRECTORY)
+      );
+      await handle.close();
+      handle = next;
     }
+    return handle;
+  } catch (error) {
+    await handle.close().catch(() => {
+    });
+    throw error;
   }
 }
-function updateCheck(options = {}) {
-  const env = options.env ?? process.env;
-  const now = options.now ?? Date.now();
-  if (!checksEnabled(env)) return null;
-  const install = options.install ?? detectInstall();
-  if (install.kind !== "global" && install.kind !== "local") return null;
-  const packageName = install.packageName ?? PACKAGE_NAME;
-  const stamp = readStamp(env, packageName);
-  if (stamp === null || now - stamp.checkedAt >= CHECK_INTERVAL_MS) {
-    writeStamp({ checkedAt: now, latest: stamp?.latest ?? null }, env, packageName);
-    (options.refresh ?? spawnRefresh)();
-  }
-  if (stamp !== null && stamp.latest !== null && isNewer(stamp.latest, CLI_VERSION)) {
-    return `harness: ${stamp.latest} is available (you have ${CLI_VERSION}) \u2014 ${upgradeHint(install)}
-`;
+async function openSafe(root, path) {
+  if (process.platform === "darwin") {
+    if (!supportsDarwinNoFollowAny())
+      throw new LocalError(
+        "Code sync requires macOS 11 or later for safe source reads."
+      );
+    return open(
+      join(root, path),
+      constants2.O_RDONLY | O_NOFOLLOW_ANY | constants2.O_NONBLOCK
+    );
   }
-  return null;
-}
-function upgradeHint(install) {
-  return install.kind === "local" ? `npm i ${upgradeInstallSpec(install)}` : `npm i -g ${upgradeInstallSpec(install)}`;
+  if (process.platform === "linux") return openLinuxBelowRoot(root, path);
+  throw new LocalError(
+    "Code sync cannot safely read source files on this platform."
+  );
 }
-function spawnRefresh() {
-  const self = process.argv[1];
-  if (self === void 0 || self === "") return;
+async function readSafe(root, path, limit) {
   try {
-    const child = spawn2(process.execPath, [self, UPDATE_CHECK_COMMAND], {
-      detached: true,
-      stdio: "ignore"
-    });
-    child.on("error", () => {
+    const handle = await openSafe(root, path);
+    try {
+      const before = await handle.stat();
+      if (!before.isFile()) return { reason: "not_regular_file" };
+      if (before.size > limit) return { reason: "too_large" };
+      const bytes = Buffer.allocUnsafe(Math.min(before.size, limit) + 1);
+      let total = 0;
+      while (total < bytes.length) {
+        const { bytesRead } = await handle.read(
+          bytes,
+          total,
+          bytes.length - total,
+          null
+        );
+        if (bytesRead === 0) break;
+        total += bytesRead;
+      }
+      const after = await handle.stat();
+      if (total > limit) return { reason: "too_large" };
+      if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || total !== after.size)
+        throw new LocalError(
+          "A source file changed during scanning; retry code sync."
+        );
+      return {
+        bytes: bytes.subarray(0, total),
+        mode: before.mode & 64 ? "100755" : "100644"
+      };
+    } finally {
+      await handle.close();
+    }
+  } catch (error) {
+    const code2 = error.code;
+    if (code2 === "ENOENT") return { reason: "deleted" };
+    if (code2 === "ELOOP") return { reason: "symlink" };
+    if (code2 === "ENOTDIR") return { reason: "not_directory" };
+    if (error instanceof LocalError) throw error;
+    throw new LocalError(
+      "Cannot read an overlay file safely; check permissions and retry code sync."
+    );
+  }
+}
+async function scanOverlay(id, served) {
+  policyFor(served, "");
+  const ignore = await readSafe(id.root, ".harnesscodeignore", 65536);
+  if ("reason" in ignore && ignore.reason === "too_large")
+    throw new LocalError("The local .harnesscodeignore exceeds 64 KiB; reduce it before code sync.");
+  if ("reason" in ignore && ignore.reason !== "deleted")
+    throw new LocalError(
+      "Cannot read .harnesscodeignore safely; fix or remove it before code sync."
+    );
+  const localIgnore = "bytes" in ignore ? decodeUtf8(
+    ignore.bytes,
+    "The local .harnesscodeignore must be valid UTF-8 before code sync."
+  ) : "";
+  const baseIgnore = await committedIgnore(id.root, id.commit);
+  if (Buffer.byteLength(baseIgnore) > 65536)
+    throw new LocalError(
+      "The committed .harnesscodeignore exceeds 64 KiB; reduce it before code sync."
+    );
+  const policy2 = policyFor(served, localIgnore);
+  const basePolicy = basePolicyFor(served, baseIgnore);
+  const paths = await changedPaths(id.root, id.commit);
+  const tree = decodeGitTree(await gitBytes(id.root, ["ls-tree", "-r", "-z", id.commit]));
+  const basePaths = new Set(tree.filter((entry) => entry.regular).map((entry) => entry.path));
+  assertDistinctPathIdentities([...tree.map((entry) => entry.path), ...paths]);
+  const changes = [];
+  const deleted = /* @__PURE__ */ new Set();
+  const blobs = /* @__PURE__ */ new Map();
+  const excluded = [];
+  const baseWouldHold = (path) => basePaths.has(path) && pathReason(path, basePolicy) === null;
+  const deleteBasePath = (path) => {
+    if (baseWouldHold(path) && !deleted.has(path)) {
+      if (changes.length >= MAX_OVERLAY_CHANGES)
+        throw new LocalError(
+          `overlay_too_large: the overlay exceeds ${MAX_OVERLAY_CHANGES} entries. Commit the ignore file so the base honors it.`
+        );
+      deleted.add(path);
+      changes.push({ op: "delete", path });
+    }
+  };
+  const candidates = new Set(paths);
+  const warnings = /* @__PURE__ */ new Set([
+    ...policy2.warnings.map((warning) => warning.startsWith("This harness-cli") ? warning : `Local .harnesscodeignore: ${warning}`),
+    ...basePolicy.warnings.map((warning) => warning.startsWith("This harness-cli") ? warning : `Committed .harnesscodeignore: ${warning}`)
+  ]);
+  for (const path of basePaths) {
+    const baseReason = pathReason(path, basePolicy);
+    const localReason = pathReason(path, policy2);
+    if (baseReason === null && (localReason === "excluded_path" || localReason === "ignored"))
+      deleteBasePath(path);
+    if (baseReason === "ignored" && localReason === null) candidates.add(path);
+  }
+  let total = 0;
+  for (const path of [...candidates].sort(
+    (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b))
+  )) {
+    const reason = pathReason(path, policy2);
+    if (reason) {
+      excluded.push({ path, reason });
+      if (reason === "ignored" || reason === "excluded_path") deleteBasePath(path);
+      const warning = extensionWarning(path, policy2);
+      if (warning) warnings.add(warning);
+      continue;
+    }
+    const read = await readSafe(id.root, path, policy2.limit);
+    if ("reason" in read) {
+      if (read.reason !== "deleted")
+        excluded.push({ path, reason: read.reason });
+      deleteBasePath(path);
+      continue;
+    }
+    const content = contentReason(read.bytes, policy2);
+    if (content) {
+      excluded.push({ path, reason: content });
+      deleteBasePath(path);
+      continue;
+    }
+    const hash2 = sha256(read.bytes);
+    if (!blobs.has(hash2)) {
+      total += read.bytes.length;
+      if (total > MAX_OVERLAY_BYTES)
+        throw new LocalError(
+          "The overlay exceeds the 64 MiB client upload limit; split the change before syncing."
+        );
+      blobs.set(hash2, read.bytes);
+    }
+    if (changes.length >= MAX_OVERLAY_CHANGES)
+      throw new LocalError(
+        `overlay_too_large: the overlay exceeds ${MAX_OVERLAY_CHANGES} entries. Commit the ignore file so the base honors it.`
+      );
+    changes.push({
+      op: "put",
+      path,
+      sha256: hash2,
+      size: read.bytes.length,
+      mode: read.mode
     });
-    child.unref();
-  } catch {
   }
+  changes.sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)));
+  const digest = sha256(
+    changes.map(
+      (c) => c.op === "delete" ? `${c.path}\0-\0-
+` : `${c.path}\0${c.sha256}\0${c.mode}
+`
+    ).join("")
+  );
+  return {
+    changes,
+    blobs,
+    excluded,
+    warnings: [...warnings],
+    digest
+  };
 }
-async function performUpdateCheck(env = process.env, now = Date.now(), packageName = detectInstall().packageName ?? PACKAGE_NAME) {
-  if (!checksEnabled(env)) return;
-  writeStamp(
-    { checkedAt: now, latest: await fetchLatestVersion(env, packageName) },
-    env,
-    packageName
+
+// src/core/code/state.ts
+import {
+  readFile,
+  mkdir,
+  writeFile,
+  rename,
+  link,
+  unlink,
+  rmdir
+} from "fs/promises";
+import { join as join2, resolve, isAbsolute } from "path";
+import { randomUUID } from "crypto";
+function canonicalServer(server) {
+  const url = new URL(server);
+  return url.origin + url.pathname.replace(/\/+$/, "");
+}
+function validPending(pending) {
+  if (pending === void 0) return true;
+  if (!pending || typeof pending !== "object" || typeof pending.digest !== "string" || !/^[a-f0-9]{64}$/.test(pending.digest)) return false;
+  const request = pending.request;
+  return !!request && typeof request === "object" && request.mode === "full" && typeof request.base_commit === "string" && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(request.base_commit) && typeof request.policy_digest === "string" && request.policy_digest.length > 0 && request.policy_digest.length <= 256 && typeof request.client_sync_id === "string" && request.client_sync_id.length > 0 && Buffer.byteLength(request.client_sync_id) <= 255 && Array.isArray(request.changes) && request.changes.length <= 2e4 && request.changes.every((change) => change && typeof change === "object" && typeof change.path === "string" && (change.op === "delete" || change.op === "put" && typeof change.sha256 === "string" && /^[a-f0-9]{64}$/.test(change.sha256) && Number.isSafeInteger(change.size) && change.size >= 0 && ["100644", "100755"].includes(change.mode))) && (pending.syncId === void 0 || typeof pending.syncId === "string") && (pending.activationAttemptedAt === void 0 || Number.isSafeInteger(pending.activationAttemptedAt) && pending.activationAttemptedAt >= 0);
+}
+function statePath(server, org, root, repoKey, directory) {
+  const canonical = canonicalServer(server);
+  const base2 = directory ?? (process.env["HARNESS_CODE_STATE_DIR"] || void 0) ?? join2(resolveCacheHome(), "harness", "code");
+  if (!isAbsolute(base2))
+    throw new LocalError("HARNESS_CODE_STATE_DIR must be an absolute path.");
+  return join2(
+    resolve(base2),
+    sha256(JSON.stringify([canonical, org.toLowerCase()])),
+    sha256(JSON.stringify([root, repoKey])) + ".json"
   );
 }
-async function fetchLatestVersion(env, packageName) {
-  const configured = env["HARNESS_REGISTRY_URL"];
-  const url = configured !== void 0 && configured.trim() !== "" ? configured.trim() : latestUrl(packageName);
+async function readState(path, server, org, root, repoKey) {
   try {
-    const response = await fetch(url, {
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS)
-    });
-    if (!response.ok) return null;
-    const parsed = await response.json();
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const version2 = parsed["version"];
-    if (typeof version2 !== "string" || parseVersion(version2) === null)
-      return null;
-    return version2;
-  } catch {
-    return null;
+    const s = JSON.parse(await readFile(path, "utf8"));
+    if (typeof s !== "object" || s === null) throw new Error();
+    const state2 = s;
+    if (state2.org.toLowerCase() !== org.toLowerCase() || state2.root !== root || state2.repoKey !== repoKey || canonicalServer(state2.server) !== canonicalServer(server) || !validPending(state2.pending) || typeof state2.viewKey !== "string" || !/^[\da-f-]{36}$/.test(state2.viewKey))
+      throw new Error();
+    return { ...state2, server: canonicalServer(state2.server), org: state2.org.toLowerCase() };
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new LocalError(
+      "The code view state is invalid or belongs to another scope. Check HARNESS_CODE_STATE_DIR; no source was uploaded."
+    );
   }
 }
-function selfHeal(options = {}) {
-  const env = options.env ?? process.env;
-  const argv2 = options.argv ?? process.argv;
-  if (truthy(env[REEXEC_SENTINEL])) {
-    return {
-      kind: "skipped",
-      reason: "already upgraded once for this command"
-    };
-  }
-  if (!autoUpgradeEnabled(env))
-    return { kind: "skipped", reason: "automatic upgrades are off" };
-  if (argv2[2] === "mcp")
-    return {
-      kind: "skipped",
-      reason: "an MCP session must not be replaced mid-stream"
-    };
-  const install = options.install ?? detectInstall();
-  if (install.kind !== "global" || install.packageRoot === null) {
-    return { kind: "skipped", reason: describeInstall(install.kind) };
-  }
-  const packageRoot = install.packageRoot;
-  const installed = versionAt(packageRoot);
-  if (installed !== null && isNewer(installed, CLI_VERSION)) {
-    return { kind: "upgraded", code: reexec(options, env, argv2) };
-  }
-  const lock = takeLock(env);
-  if (lock === null)
-    return {
-      kind: "skipped",
-      reason: "another harness process is already upgrading"
-    };
+async function initialState(path, server, org, root, repoKey) {
+  const previous = await readState(path, server, org, root, repoKey);
+  if (previous) return previous;
+  const state2 = { server: canonicalServer(server), org: org.toLowerCase(), root, repoKey, viewKey: randomUUID() };
+  await mkdir(join2(path, ".."), { recursive: true, mode: 448 });
+  const tmp = `${path}.${randomUUID()}.tmp`;
   try {
-    const stillHeld = () => readHolder(lock.path)?.pid === lock.pid;
-    const result = (options.runInstall ?? npmInstallGlobal)(install, stillHeld);
-    if (!result.ok) return { kind: "failed", reason: result.detail };
-    const after = versionAt(packageRoot);
-    if (after !== null && after === installed) {
-      return {
-        kind: "failed",
-        reason: `still ${after} after upgrading \u2014 no newer release is published`
-      };
-    }
-    if (after !== null && installed !== null && !isNewer(after, installed)) {
-      return {
-        kind: "failed",
-        reason: `npm left ${after} installed, which is not newer than ${installed}`
-      };
+    await writeFile(tmp, JSON.stringify(state2) + "\n", { flag: "wx", mode: 384 });
+    try {
+      await link(tmp, path);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      const raced = await readState(path, server, org, root, repoKey);
+      if (!raced) throw new Error("initial state disappeared");
+      return raced;
     }
+    return state2;
+  } catch {
+    throw new LocalError("Cannot save isolated code view state.");
   } finally {
-    releaseLock(lock);
+    await unlink(tmp).catch(() => {
+    });
   }
-  return { kind: "upgraded", code: reexec(options, env, argv2) };
 }
-function reexec(options, env, argv2) {
-  return (options.reexec ?? reexecSelf)(
-    { ...env, [REEXEC_SENTINEL]: "1" },
-    argv2
-  );
-}
-function describeInstall(kind) {
-  switch (kind) {
-    case "checkout":
-      return "this is a git checkout, not an npm install";
-    case "local":
-      return "this copy is a project dependency, not a global install";
-    case "npx":
-      return "npx runs a throwaway copy";
-    default:
-      return "cannot tell how this CLI was installed";
-  }
-}
-function npmInstallGlobal(install, stillHeld) {
-  const globalRoot = npmGlobalRoot();
-  if (globalRoot === null)
-    return { ok: false, detail: "npm did not say where its global root is" };
-  if (globalRoot.includes("***")) {
-    return {
-      ok: false,
-      detail: "npm redacted its own global root, so this copy's location cannot be confirmed"
-    };
-  }
-  if (install.nodeModules === null || !samePath(globalRoot, install.nodeModules)) {
-    return {
-      ok: false,
-      detail: `this copy lives in ${install.nodeModules ?? "an unrecognized place"}, not npm's global root (${globalRoot})`
-    };
-  }
+async function saveState(path, state2) {
+  const tmp = `${path}.${randomUUID()}.tmp`;
   try {
-    accessSync2(globalRoot, constants2.W_OK);
+    await writeFile(tmp, JSON.stringify({ ...state2, server: canonicalServer(state2.server), org: state2.org.toLowerCase() }) + "\n", {
+      flag: "wx",
+      mode: 384
+    });
+    await rename(tmp, path);
   } catch {
-    return {
-      ok: false,
-      detail: `${globalRoot} is not writable \u2014 upgrade it yourself`
-    };
-  }
-  if (!stillHeld()) {
-    return {
-      ok: false,
-      detail: "lost the upgrade lock while preparing \u2014 another process took over"
-    };
-  }
-  process.stderr.write(
-    named(`harness: upgrading ${install.packageName ?? PACKAGE_NAME} \u2026
-`)
-  );
-  const args = [
-    "install",
-    "--global",
-    "--ignore-scripts",
-    "--no-audit",
-    "--no-fund",
-    "--no-update-notifier",
-    "--loglevel=error",
-    upgradeInstallSpec(install)
-  ];
-  const result = spawnSync(npmCommand(), args, {
-    // npm's diagnostics belong on stderr with ours; stdout stays the
-    // command's own, so its summary is dropped rather than piped into jq.
-    stdio: ["ignore", "ignore", "inherit"],
-    timeout: INSTALL_TIMEOUT_MS,
-    ...npmSpawnOptions()
-  });
-  if (result.error !== void 0)
-    return { ok: false, detail: result.error.message };
-  if (result.status !== 0) {
-    return {
-      ok: false,
-      detail: `npm install exited ${result.status ?? `on ${String(result.signal)}`}`
-    };
+    throw new LocalError(
+      "Cannot save code sync progress; retry with the same worktree and state directory."
+    );
+  } finally {
+    await unlink(tmp).catch(() => {
+    });
   }
-  return { ok: true, detail: "" };
 }
-function npmGlobalRoot() {
+async function withSyncLock(path, action) {
+  const lock = path + ".lock";
+  await mkdir(join2(path, ".."), { recursive: true, mode: 448 });
+  try {
+    await mkdir(lock, { mode: 448 });
+  } catch (error) {
+    if (error.code === "EEXIST")
+      throw new LocalError(
+        `A code sync is already running for this view. Wait for it to finish. If it was interrupted, confirm no sync is running before removing its lock directory: ${lock}`
+      );
+    throw new LocalError(
+      "Cannot lock code sync progress; check the state directory permissions."
+    );
+  }
   try {
-    const result = spawnSync(npmCommand(), ["root", "--global"], {
-      encoding: "utf8",
-      timeout: NPM_ROOT_TIMEOUT_MS,
-      ...npmSpawnOptions()
+    await writeFile(join2(lock, "owner"), `${process.pid}
+`, {
+      flag: "wx",
+      mode: 384
     });
-    if (result.status !== 0 || typeof result.stdout !== "string") return null;
-    const path = result.stdout.trim();
-    return path === "" ? null : path;
-  } catch {
-    return null;
+    return await action();
+  } finally {
+    await unlink(join2(lock, "owner")).catch(() => {
+    });
+    try {
+      await rmdir(lock);
+    } catch {
+      try {
+        process.stderr.write(named(
+          `harness: Warning: code sync lock cleanup failed at ${clean(lock)}. If the lock remains, confirm no sync is running before removing it.
+`
+        ));
+      } catch {
+      }
+    }
   }
 }
-function npmCommand() {
-  return process.platform === "win32" ? "npm.cmd" : "npm";
+
+// src/core/code/sync.ts
+async function baseReady(api, repo, commit, options) {
+  const timeout = options.pollTimeoutMs ?? 6e5;
+  const sleep = options.sleep ?? delay2;
+  let waited = 0;
+  let interval = 1e3;
+  const started = Date.now();
+  for (let attempts = 0; attempts < 600; attempts++) {
+    const base2 = await api.getBase(repo, commit, options.skipped === true);
+    if (base2.state === "complete" || base2.state === "ready") return base2;
+    if (base2.state === "failed")
+      throw new CommandError(
+        "The server could not build this commit\u2019s base. Check code status --skipped, then retry after the server backoff."
+      );
+    const backoff = base2.retry_after_ms === 0 ? interval : base2.retry_after_ms ?? interval;
+    if (!Number.isFinite(backoff) || backoff < 0 || Math.max(waited, Date.now() - started) + backoff > timeout)
+      throw new CommandError(
+        "Timed out waiting for the server-built base; retry code sync to resume."
+      );
+    await sleep(backoff);
+    waited += backoff;
+    interval = Math.min(interval * 2, 1e4);
+  }
+  throw new CommandError("The base is still fetching; retry code sync later.");
+}
+function stale(error) {
+  return error instanceof HttpError && error.status === 409 && error.body["error"] === "stale_policy";
 }
-function npmSpawnOptions() {
-  return process.platform === "win32" ? { shell: true } : {};
+function withinActivationRetention(attemptedAt) {
+  const elapsed = typeof attemptedAt === "number" ? Date.now() - attemptedAt : NaN;
+  return Number.isFinite(elapsed) && elapsed >= 0 && elapsed < 60 * 6e4;
 }
-function samePath(left, right) {
-  const resolve = (path) => {
+var ReplacedSyncError = class extends CommandError {
+  constructor() {
+    super(
+      "The server replaced this sync before activation. Retry code sync with no other sync running for this view."
+    );
+  }
+};
+function policyScope(policy2) {
+  if (!/^[\da-f]{8}-(?:[\da-f]{4}-){3}[\da-f]{12}$/i.test(policy2.org_id) || !policy2.policy_digest || !Number.isSafeInteger(policy2.max_file_bytes) || policy2.max_file_bytes < 1)
+    throw new CommandError(
+      "The server did not provide a valid organization and upload policy; no source was uploaded."
+    );
+  policyFor(policy2, "");
+}
+async function syncCode(api, options) {
+  const id = await identity(options.cwd);
+  let policyRestarts = 0;
+  let syncRestarts = 0;
+  for (let restart = 0; restart < 3; restart++) {
+    const policy2 = await api.getPolicy();
+    policyScope(policy2);
+    const path = statePath(
+      api.origin,
+      policy2.org_id,
+      id.root,
+      id.repoKey,
+      options.stateDir
+    );
     try {
-      return realpathSync(path);
-    } catch {
-      return path;
+      return await withSyncLock(path, async () => {
+        const state2 = await initialState(
+          path,
+          api.origin,
+          policy2.org_id,
+          id.root,
+          id.repoKey
+        );
+        const repo = await api.putRepository(id.repoKey);
+        if (repo.repo_key !== id.repoKey)
+          throw new CommandError(
+            "The server resolved a different repository; no source was uploaded."
+          );
+        if (state2.repositoryId && state2.repositoryId !== repo.repository_id) {
+          delete state2.viewId;
+          delete state2.pending;
+          delete state2.activated;
+        }
+        state2.repositoryId = repo.repository_id;
+        state2.baseCommit = id.commit;
+        await saveState(path, state2);
+        const base2 = await baseReady(
+          api,
+          repo.repository_id,
+          id.commit,
+          options
+        );
+        if (base2.policy_digest && base2.policy_digest !== policy2.policy_digest)
+          throw new HttpError(409, "The upload policy changed", {
+            error: "stale_policy"
+          });
+        const overlay = await scanOverlay(id, policy2);
+        const view2 = await api.putView(repo.repository_id, state2.viewKey);
+        if (state2.viewId !== void 0 && state2.viewId !== view2.view_id && view2.repository_id === repo.repository_id && view2.view_key === state2.viewKey) {
+          let removed = false;
+          try {
+            await api.getView(state2.viewId);
+          } catch (error) {
+            if (error instanceof HttpError && error.status === 404)
+              removed = true;
+            else throw error;
+          }
+          if (removed) {
+            delete state2.viewId;
+            delete state2.pending;
+            delete state2.activated;
+          }
+        }
+        if (view2.repository_id !== repo.repository_id || view2.view_key !== state2.viewKey || state2.viewId !== void 0 && state2.viewId !== view2.view_id)
+          throw new CommandError(
+            "The server view does not match this repository/worktree; no source was uploaded."
+          );
+        state2.viewId = view2.view_id;
+        const forgetReplaced = async () => {
+          delete state2.pending;
+          await saveState(path, state2);
+          throw new ReplacedSyncError();
+        };
+        const receipt = async (syncId) => {
+          try {
+            const previous = await api.getSync(view2.view_id, syncId);
+            if (previous.id !== syncId)
+              throw new CommandError("The server returned a different sync; activation remains unverified.");
+            if (previous.state === "receiving") return null;
+            if (!Number.isSafeInteger(previous.version) || previous.version === null || previous.version < 1)
+              throw new CommandError("The server did not return an activation version; retry code status.");
+            return { pending_version: previous.version, state: previous.state };
+          } catch (error) {
+            if (error instanceof HttpError && error.status === 404) {
+              if (withinActivationRetention(state2.pending?.activationAttemptedAt))
+                return forgetReplaced();
+              if (state2.pending?.activationAttemptedAt === void 0)
+                throw new CommandError("The sync disappeared without a recorded activation attempt. Check code status before retrying code sync.");
+              throw new CommandError("The previous activation can no longer be verified after retention. Check code status before syncing again.");
+            }
+            throw error;
+          }
+        };
+        const reconcileFailure = async (syncId, original) => {
+          try {
+            const recovered = await receipt(syncId);
+            if (!recovered && original instanceof HttpError && original.status >= 400 && original.status < 500 && original.status !== 429 && state2.pending) {
+              delete state2.pending.activationAttemptedAt;
+              await saveState(path, state2);
+            }
+            return recovered;
+          } catch (secondary) {
+            if (secondary instanceof ReplacedSyncError) throw secondary;
+            const primary = secondary instanceof CommandError ? secondary : original;
+            const cause = primary === secondary ? original : secondary;
+            try {
+              if (primary instanceof Error && primary.cause === void 0 && cause !== primary) primary.cause = cause;
+            } catch {
+            }
+            throw primary;
+          }
+        };
+        let current = state2.pending;
+        const matchesCurrent = current && current.digest === overlay.digest && current.request?.mode === "full" && current.request.base_commit === id.commit && current.request.policy_digest === policy2.policy_digest && typeof current.request.client_sync_id === "string" && JSON.stringify(current.request.changes) === JSON.stringify(overlay.changes);
+        if (current?.syncId && current.activationAttemptedAt !== void 0 && !matchesCurrent) {
+          const prior = current;
+          const originalSyncId = current.syncId;
+          let recovered = await receipt(originalSyncId);
+          if (!recovered) {
+            prior.activationAttemptedAt = Date.now();
+            await saveState(path, state2);
+            try {
+              recovered = await api.activate(view2.view_id, originalSyncId);
+            } catch (error) {
+              recovered = await reconcileFailure(originalSyncId, error);
+              if (!recovered) throw error;
+            }
+          }
+          state2.activated = {
+            baseCommit: prior.request.base_commit,
+            overlayDigest: prior.digest,
+            pendingVersion: recovered.pending_version,
+            policyDigest: prior.request.policy_digest
+          };
+          delete state2.pending;
+          await saveState(path, state2);
+          current = void 0;
+        }
+        const request = matchesCurrent && current ? current.request : {
+          client_sync_id: randomUUID2(),
+          base_commit: id.commit,
+          mode: "full",
+          changes: overlay.changes,
+          policy_digest: policy2.policy_digest
+        };
+        state2.pending = current && current.request === request ? current : { digest: overlay.digest, request };
+        await saveState(path, state2);
+        const finish = async (syncId, activated3, uploadedBlobs) => {
+          state2.activated = {
+            baseCommit: id.commit,
+            overlayDigest: overlay.digest,
+            pendingVersion: activated3.pending_version,
+            policyDigest: policy2.policy_digest
+          };
+          delete state2.pending;
+          await saveState(path, state2);
+          return {
+            repository_id: repo.repository_id,
+            repo_key: id.repoKey,
+            org_id: policy2.org_id,
+            view_id: view2.view_id,
+            view_key: state2.viewKey,
+            sync_id: syncId,
+            base_commit: id.commit,
+            base: base2,
+            overlay_digest: overlay.digest,
+            changed_files: overlay.changes.length,
+            uploaded_blobs: uploadedBlobs,
+            excluded: overlay.excluded,
+            warnings: overlay.warnings,
+            policy_restarts: policyRestarts,
+            sync_restarts: syncRestarts,
+            ...activated3
+          };
+        };
+        if (state2.pending.syncId && state2.pending.activationAttemptedAt !== void 0) {
+          const recovered = await receipt(state2.pending.syncId);
+          if (recovered) return finish(state2.pending.syncId, recovered, 0);
+        }
+        const opened2 = await api.openSync(view2.view_id, request);
+        if (opened2.rejected.length)
+          throw new CommandError(
+            `The server refused ${opened2.rejected.length} overlay entries; no sync was activated. Refetch the policy and check the skipped-files report.`
+          );
+        state2.pending.syncId = opened2.sync_id;
+        await saveState(path, state2);
+        if (opened2.state !== "receiving") {
+          const recovered = await receipt(opened2.sync_id);
+          if (recovered) return finish(opened2.sync_id, recovered, 0);
+          throw new CommandError("The server returned an inconsistent sync state; no new version was requested.");
+        }
+        const missing = [...new Set(opened2.missing)];
+        for (const hash2 of missing)
+          if (!overlay.blobs.has(hash2))
+            throw new CommandError(
+              "The server requested an unexpected blob not present in this overlay; no blobs were uploaded."
+            );
+        let activating = false;
+        let activated2;
+        try {
+          let next = 0;
+          let failure;
+          await Promise.all(Array.from({ length: Math.min(4, missing.length) }, async () => {
+            while (!failure && next < missing.length) {
+              const hash2 = missing[next++];
+              try {
+                await api.putBlob(hash2, overlay.blobs.get(hash2));
+              } catch (error) {
+                failure ??= { error };
+              }
+            }
+          }));
+          if (failure) throw failure.error;
+          state2.pending.activationAttemptedAt = Date.now();
+          await saveState(path, state2);
+          activating = true;
+          activated2 = await api.activate(view2.view_id, opened2.sync_id);
+        } catch (error) {
+          const replaced = error instanceof HttpError && (activating ? error.status === 404 : error.status === 409 && error.body["error"] === "unexpected_blob");
+          if (replaced) {
+            if (activating && !withinActivationRetention(state2.pending?.activationAttemptedAt))
+              throw new CommandError("The activation retry exceeded its retention window. Check code status before syncing again.");
+            return forgetReplaced();
+          }
+          if (activating) {
+            const recovered = await reconcileFailure(opened2.sync_id, error);
+            if (recovered) return finish(opened2.sync_id, recovered, missing.length);
+          }
+          throw error;
+        }
+        return finish(opened2.sync_id, activated2, missing.length);
+      });
+    } catch (error) {
+      if (stale(error) && restart < 2) {
+        policyRestarts++;
+        continue;
+      }
+      if (error instanceof ReplacedSyncError && restart < 2) {
+        syncRestarts++;
+        continue;
+      }
+      throw error;
     }
-  };
-  return resolve(left) === resolve(right);
-}
-function reexecSelf(env, argv2) {
-  const self = argv2[1];
-  if (self === void 0) return 1;
-  const result = spawnSync(process.execPath, [self, ...argv2.slice(2)], {
-    stdio: "inherit",
-    env
-  });
-  if (result.error !== void 0) {
-    process.stderr.write(
-      named(`harness: upgraded, but re-running failed: ${result.error.message}
-`)
+  }
+  throw new CommandError(
+    "The upload policy kept changing. Retry code sync after it settles."
+  );
+}
+async function statusCode(api, options) {
+  const id = await identity(options.cwd);
+  const policy2 = await api.getPolicy();
+  policyScope(policy2);
+  const path = statePath(
+    api.origin,
+    policy2.org_id,
+    id.root,
+    id.repoKey,
+    options.stateDir
+  );
+  const state2 = await readState(
+    path,
+    api.origin,
+    policy2.org_id,
+    id.root,
+    id.repoKey
+  );
+  const repository = options.skipped ? await api.putRepository(id.repoKey) : void 0;
+  if (repository && repository.repo_key !== id.repoKey)
+    throw new CommandError(
+      "The server resolved a different repository; its base status cannot be trusted."
     );
-    return 1;
+  const repositoryId = repository?.repository_id ?? state2?.repositoryId;
+  const withoutView = async () => {
+    const base3 = options.skipped && repositoryId ? await api.getBase(repositoryId, id.commit, true) : void 0;
+    return {
+      state: base3?.state === "failed" ? "failed" : base3?.state === "fetching" ? "fetching" : "not_synced",
+      org_id: policy2.org_id,
+      repo_key: id.repoKey,
+      base_commit: id.commit,
+      ...base3 ? { base: base3 } : {}
+    };
+  };
+  if (!state2?.viewId || repository && repositoryId !== state2.repositoryId) return withoutView();
+  let view2;
+  try {
+    view2 = await api.getView(state2.viewId);
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404) return withoutView();
+    throw error;
   }
-  return result.status ?? 1;
+  if (view2.repository_id !== state2.repositoryId || view2.view_id !== state2.viewId || view2.view_key !== state2.viewKey)
+    throw new CommandError(
+      "The server view does not match this repository/worktree; its status cannot be trusted."
+    );
+  const overlay = await scanOverlay(id, policy2);
+  const current = view2.active?.base_commit === id.commit && view2.active.overlay_digest === overlay.digest && state2.activated?.baseCommit === view2.active.base_commit && state2.activated.overlayDigest === view2.active.overlay_digest && state2.activated.pendingVersion === view2.active.version && state2.activated.policyDigest === policy2.policy_digest;
+  const base2 = options.skipped && state2.repositoryId ? await api.getBase(state2.repositoryId, id.commit, true) : void 0;
+  return {
+    state: base2?.state === "failed" || view2.pending?.state === "failed" ? "failed" : current ? "current" : view2.pending ? "pending" : view2.active ? "stale" : "not_synced",
+    org_id: policy2.org_id,
+    repo_key: id.repoKey,
+    base_commit: id.commit,
+    ...view2,
+    local_overlay_digest: overlay.digest,
+    excluded: overlay.excluded,
+    warnings: overlay.warnings,
+    ...base2 ? { base: base2 } : {}
+  };
 }
-function takeLock(env) {
-  const path = join2(resolveCacheHome(env), "harness", "upgrade.lock");
-  const temporary = `${path}.${process.pid}.tmp`;
+
+// src/core/code/query.ts
+import { z as z2 } from "zod";
+var hash = z2.string().regex(/^[0-9a-f]{64}$/);
+var queryView = z2.object({
+  view_id: z2.string().uuid(),
+  repository_id: z2.string().uuid(),
+  view_key: z2.string().min(1),
+  active: z2.object({ version: z2.number().int().positive(), base_commit: z2.string().regex(/^[0-9a-f]{40}$/), overlay_digest: hash }).passthrough(),
+  pending: z2.object({ version: z2.number().int(), state: z2.string(), progress: z2.object({ done: z2.number().int().nonnegative(), total: z2.number().int().nonnegative() }).nullable().optional() }).passthrough().nullable()
+}).passthrough();
+var envelopeSchema = z2.object({
+  data: z2.unknown(),
+  meta: z2.object({ contract: z2.literal("1.3"), view: queryView, truncation: z2.object({ truncated: z2.boolean() }).passthrough() }).passthrough()
+}).passthrough();
+var citationSchema = z2.object({ path: z2.string().min(1), start_line: z2.number().int().positive(), end_line: z2.number().int().positive(), sha256: hash, version: z2.number().int().positive(), from: z2.enum(["base", "overlay"]), snippet: z2.string().optional() }).passthrough();
+var record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var shell = (text) => "'" + text.replaceAll("'", "'\\''") + "'";
+function fail() {
+  throw new CommandError("The code query API returned an invalid contract 1.3 response; no result was presented.");
+}
+function integer(value, name, min, max) {
+  if (value !== void 0 && (!Number.isSafeInteger(value) || value < min || value > max)) throw new UsageError(`${name} must be an integer from ${min} to ${max}.`);
+}
+function validateQuery(operation, p) {
+  const texts = [p.q, p.symbol, p.kind, p.pathPrefix, ...p.symbols ?? [], ...p.files ?? []];
+  if (texts.some((s) => s !== void 0 && (typeof s !== "string" || s.length === 0 || Buffer.byteLength(s) > 8192 || /[\x00-\x1f\x7f-\x9f]/.test(s) || Buffer.from(s).toString("utf8") !== s))) throw new UsageError("Code query arguments must be nonempty UTF-8 text without control characters (at most 8 KiB each).");
+  if (operation === "search" && !p.q?.trim()) throw new UsageError("usage: harness code search <query>");
+  if (operation === "explain" && !p.symbol) throw new UsageError("usage: harness code explain <symbol-id>");
+  if (operation === "context" && Number(Boolean(p.symbol)) + Number(Boolean(p.q?.trim())) !== 1) throw new UsageError("code context requires exactly one query or --symbol.");
+  if (operation === "affected") {
+    const seeds = (p.symbols?.length ?? 0) + (p.files?.length ?? 0);
+    if (seeds < 1 || seeds > 200) throw new UsageError("code affected needs 1 to 200 --symbol/--file seeds.");
+    if (Buffer.byteLength(JSON.stringify(p)) > 24e4) throw new UsageError("Code affected seeds exceed the request size limit; narrow the selection.");
+  }
+  integer(p.limit, "limit", 1, 100);
+  integer(p.depth, "depth", 1, 6);
+  integer(p.budgetTokens, "budget-tokens", 100, operation === "context" ? 32e3 : 16e3);
+}
+function command(op, p) {
+  const parts = ["harness", "code", op];
+  if (p.q !== void 0) parts.push(shell(p.q));
+  if (op === "explain" && p.symbol) parts.push(shell(p.symbol));
+  else if (p.symbol) parts.push("--symbol", shell(p.symbol));
+  for (const id of p.symbols ?? []) parts.push("--symbol", shell(id));
+  for (const file of p.files ?? []) parts.push("--file", shell(file));
+  for (const [key, value] of [["limit", p.limit], ["depth", p.depth], ["budget-tokens", p.budgetTokens], ["kind", p.kind], ["path-prefix", p.pathPrefix]])
+    if (value !== void 0) parts.push(`--${key}`, typeof value === "number" ? String(value) : shell(value));
+  if (p.includeAmbiguous) parts.push("--include-ambiguous");
+  if (p.includeTypes) parts.push("--include-types");
+  if (p.worktree) parts.push("--path", shell(p.worktree));
+  return named(parts.join(" "));
+}
+function nextCommand(op, p, next) {
+  if (!record(next)) return null;
+  const updated = { ...p };
+  let changed = false;
+  for (const [key, field] of [["limit", "limit"], ["depth", "depth"], ["budget_tokens", "budgetTokens"]]) {
+    if (key === "limit" && op !== "search" || key === "depth" && op !== "affected" || key === "budget_tokens" && op !== "explain" && op !== "context") continue;
+    if (typeof next[key] === "number") {
+      updated[field] = next[key];
+      changed = true;
+    }
+  }
+  if (!changed) return null;
   try {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(temporary, `${process.pid}
-`);
+    validateQuery(op, updated);
   } catch {
     return null;
   }
+  return command(op, updated);
+}
+function renderQuery(operation, params, raw) {
+  const parsed = envelopeSchema.safeParse(raw);
+  if (!parsed.success) fail();
+  const response = parsed.data;
+  if (operation === "search" ? !Array.isArray(response.data) : !record(response.data)) fail();
+  const { view: view2, truncation } = response.meta;
+  const guidance = [];
+  const lines = [`View ${view2.view_id}: version ${view2.active.version}; base ${view2.active.base_commit}; overlay ${view2.active.overlay_digest}`];
+  if (view2.pending) lines.push(`Pending version ${view2.pending.version}: ${clean(view2.pending.state)}${view2.pending.progress ? ` (${view2.pending.progress.done}/${view2.pending.progress.total})` : ""}`);
+  let visited = 0;
+  const buckets = {};
+  const walk = (value, label3, depth, enclosingSymbol, countBuckets = true) => {
+    if (++visited > 1e5 || depth > 32) fail();
+    if (record(value)) {
+      const symbol = typeof value["symbol_id"] === "string" ? value["symbol_id"] : enclosingSymbol;
+      if ("path" in value && "start_line" in value && "sha256" in value) {
+        const citation = citationSchema.safeParse(value);
+        if (!citation.success || citation.data.end_line < citation.data.start_line || citation.data.version !== view2.active.version) fail();
+        const c = citation.data;
+        lines.push(`${label3}: ${clean(c.path)}:${c.start_line}${c.end_line === c.start_line ? "" : `-${c.end_line}`}@${c.sha256} [${c.from}, version ${c.version}]`);
+        const context = command("context", { ...symbol || params.symbol ? { symbol: symbol ?? params.symbol } : { q: params.q ?? "symbol name" }, worktree: params.worktree });
+        lines.push(c.snippet !== void 0 ? c.snippet.split("\n").map(clean).join("\n") : `Snippet not supplied; retrieve indexed text: ${context}`);
+        for (const [key, extra] of Object.entries(value)) if (!["path", "start_line", "end_line", "sha256", "version", "from", "snippet"].includes(key)) walk(extra, `${label3}.${clean(key)}`, depth + 1, symbol, countBuckets);
+      } else for (const [key, child] of Object.entries(value)) walk(child, `${label3}.${clean(key)}`, depth + 1, symbol, countBuckets);
+    } else if (Array.isArray(value)) {
+      if (countBuckets && label3 !== "data") buckets[label3.slice(5)] = value.length;
+      if (!value.length) lines.push(`${label3}: []`);
+      value.forEach((v, i) => walk(v, `${label3}[${i}]`, depth + 1, enclosingSymbol, false));
+    } else lines.push(`${label3}: ${clean(typeof value === "string" ? value : JSON.stringify(value))}`);
+  };
+  walk(response.data, "data", 0);
+  const counts = Array.isArray(response.data) ? response.data.length : buckets;
+  const total = typeof truncation["total"] === "number" ? truncation["total"] : response.meta["total"];
+  lines.push(`Truncated: ${truncation.truncated ? "yes" : "no"}; returned: ${JSON.stringify(counts)}; total: ${typeof total === "number" ? total : "unknown (not supplied by server)"}`);
+  if (truncation.truncated) {
+    lines.push(`Truncation metadata: ${JSON.stringify(truncation)}`);
+    const next = nextCommand(operation, params, truncation["next"]);
+    guidance.push(next ? `Next: ${next}` : `Next: narrow the query or use rg -n; ${typeof truncation["hint"] === "string" ? clean(truncation["hint"]) : "the server supplied no larger request."}`);
+  }
+  const coverage = record(response.data) ? response.data["not_tracked"] : void 0;
+  if (Array.isArray(coverage) && coverage.length) {
+    for (const entry of coverage) if (record(entry)) guidance.push(`Coverage${entry["partial"] === true ? " (partial)" : ""}: ${clean(entry["reason"])}`);
+  }
+  if (Array.isArray(coverage) && coverage.length || Array.isArray(response.data) && response.data.length === 0) {
+    const symbol = record(response.data) && record(response.data["symbol"]) ? response.data["symbol"]["name"] : void 0;
+    guidance.push(`Search locally: rg -n --fixed-strings -- ${shell(params.q ?? (typeof symbol === "string" ? symbol : "symbol name"))} .`);
+  }
+  return { json: { ...response, guidance }, human: lines.concat(guidance).join("\n") + "\n" };
+}
+async function queryCode(api, operation, params, options) {
+  validateQuery(operation, params);
+  const id = await identity(options.cwd);
+  const policy2 = await api.getPolicy();
+  if (!z2.string().uuid().safeParse(policy2.org_id).success) fail();
+  const path = statePath(api.origin, policy2.org_id, id.root, id.repoKey, options.stateDir);
+  const state2 = await readState(path, api.origin, policy2.org_id, id.root, id.repoKey);
+  if (!state2?.viewId || !state2.repositoryId) throw new CommandError(`This worktree has no code view. Run harness code sync --path ${shell(id.root)} first.`);
+  const view2 = await api.getView(state2.viewId);
+  const matches = (v) => v.view_id === state2.viewId && v.repository_id === state2.repositoryId && v.view_key === state2.viewKey;
+  if (!matches(view2)) throw new CommandError("The code view does not match this repository/worktree; no query was sent.");
+  if (!view2.active) throw new CommandError(`The view has no indexed version yet. Check harness code status --path ${shell(id.root)} until indexing finishes.`);
   try {
-    for (let attempt = 0; attempt < 2; attempt++) {
-      try {
-        linkSync(temporary, path);
-        return { path, pid: process.pid };
-      } catch {
-        const holder = readHolder(path);
-        if (holder === null) continue;
-        const aged = Date.now() - holder.mtimeMs > LOCK_STALE_MS;
-        const abandoned = holder.pid === null ? aged : !running(holder.pid) || aged;
-        if (!abandoned) return null;
-        try {
-          rmSync(path, { force: true });
-        } catch {
-          return null;
-        }
-      }
-    }
-    return null;
-  } finally {
-    try {
-      rmSync(temporary, { force: true });
-    } catch {
-    }
+    const raw = await api.query(state2.viewId, operation, params);
+    const result = renderQuery(operation, { ...params, worktree: id.root }, raw);
+    if (!matches(result.json.meta.view)) throw new CommandError("The query view does not match this repository/worktree; no result was presented.");
+    return result;
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404 && operation !== "search") throw new CommandError(`The code symbol or view was not found. Search again with ${command("search", { q: "symbol name", worktree: id.root })}; symbol IDs are opaque and can change after edits. Check code status for a removed view.`);
+    throw error;
   }
 }
-function releaseLock(lock) {
+
+// src/commands/code/index.ts
+function enterWorktree(options) {
+  const refused = () => options.path === void 0 ? new LocalError("Cannot enter the code worktree safely; check the current directory.") : new UsageError("Cannot enter the code worktree safely; check --path.");
   try {
-    if (readHolder(lock.path)?.pid !== lock.pid) return;
-    rmSync(lock.path, { force: true });
+    const cwd = process.cwd();
+    const before = statSync(".");
+    const declared = statSync(cwd);
+    if (before.dev !== declared.dev || before.ino !== declared.ino) throw refused();
+    const supplied = options.path ?? cwd;
+    if (/[\x00-\x1f\x7f-\x9f]/.test(supplied) || Buffer.from(supplied, "utf8").toString("utf8") !== supplied || options.path !== void 0 && supplied.includes("\uFFFD")) throw refused();
+    const path = resolve2(supplied), target = statSync(path);
+    if (options.path === void 0 && (before.dev !== target.dev || before.ino !== target.ino)) throw refused();
+    process.chdir(path);
+    const entered = statSync(".");
+    if (entered.dev !== target.dev || entered.ino !== target.ino) throw refused();
+    const canonical = realpathSync(".");
+    const pinned = statSync(canonical);
+    if (pinned.dev !== entered.dev || pinned.ino !== entered.ino) throw refused();
+    return { ...options, path: canonical };
   } catch {
+    throw refused();
   }
 }
-function readHolder(path) {
+async function sync(ctx, options = {}) {
   try {
-    const mtimeMs = statSync(path).mtimeMs;
-    const pid = Number.parseInt(readFileSync(path, "utf8").trim(), 10);
-    return { pid: Number.isInteger(pid) && pid > 0 ? pid : null, mtimeMs };
-  } catch {
-    return null;
+    const result = await syncCode(new HttpCodeApi(ctx.config), {
+      cwd: options.path ?? process.cwd(),
+      skipped: options.skipped
+    });
+    return {
+      json: result,
+      exitCode: result.state === "failed" ? 1 : 0,
+      human: `${clean(result.repo_key)}: ${clean(result.state)} version ${result.pending_version}; uploaded ${result.uploaded_blobs} overlay blobs.
+View: ${result.view_id}
+${result.excluded.length} overlay files skipped; ${result.base.excluded_count ?? 0} base files skipped.${options.skipped ? "\n" + (result.base.skipped ?? []).map((s) => `${clean(s.path)}: ${clean(s.reason)}`).join("\n") : ""}
+${result.warnings.map((w) => `Warning: ${clean(w)}
+`).join("")}`
+    };
+  } catch (error) {
+    throw error instanceof HttpError ? describeCodeError(error) : error;
   }
 }
-function running(pid) {
-  if (pid === null) return false;
+async function status2(ctx, options = {}) {
   try {
-    process.kill(pid, 0);
-    return true;
+    const result = await statusCode(new HttpCodeApi(ctx.config), {
+      cwd: options.path ?? process.cwd(),
+      skipped: options.skipped
+    });
+    const report = "base" in result ? result.base : void 0;
+    const pending = "pending" in result ? result.pending : null;
+    const serverError = pending?.error ?? report?.error;
+    const failure = serverError && typeof serverError === "object" && "message" in serverError && typeof serverError.message === "string" ? clean(serverError.message) : "";
+    return {
+      json: result,
+      exitCode: result.state === "failed" ? 1 : 0,
+      human: `${clean(result.repo_key)}: ${result.state.replace("_", " ")}${failure ? ": " + failure : ""}
+${report?.skipped?.map((s) => `${clean(s.path)}: ${clean(s.reason)}
+`).join("") ?? ""}${("warnings" in result ? result.warnings : [])?.map((w) => `Warning: ${clean(w)}
+`).join("") ?? ""}`
+    };
   } catch (error) {
-    return error.code === "EPERM";
+    throw error instanceof HttpError ? describeCodeError(error) : error;
   }
 }
-function truthy(value) {
-  if (value === void 0) return false;
-  const normalized = value.trim().toLowerCase();
-  return normalized !== "" && normalized !== "0" && normalized !== "false" && normalized !== "no";
-}
-function checksEnabled(env) {
-  return !truthy(env["CI"]) && !truthy(env["HARNESS_NO_UPDATE_CHECK"]);
-}
-function autoUpgradeEnabled(env) {
-  if (!checksEnabled(env)) return false;
-  const explicit = env["HARNESS_AUTO_UPGRADE"];
-  if (explicit !== void 0 && explicit.trim() !== "") return truthy(explicit);
-  return true;
+async function query(ctx, operation, params, options = {}) {
+  try {
+    return await queryCode(new HttpCodeApi(ctx.config), operation, params, { cwd: options.path ?? process.cwd() });
+  } catch (error) {
+    throw error instanceof HttpError ? describeCodeError(error) : error;
+  }
 }
 
 // src/cli.ts
 function promptLine(question) {
-  const readline = createInterface2({
+  const readline = createInterface({
     input: process.stdin,
     output: process.stderr
   });
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     readline.question(question, (answer) => {
       readline.close();
-      resolve(answer);
+      resolve3(answer);
     });
   });
 }
-function exitWith(code) {
-  const drain = (stream) => new Promise((resolve) => stream.write("", () => resolve()));
+function exitWith(code2) {
+  const drain = (stream) => new Promise((resolve3) => stream.write("", () => resolve3()));
   return Promise.all([drain(process.stdout), drain(process.stderr)]).then(
-    () => process.exit(code)
+    () => process.exit(code2)
   );
 }
 guardBrokenPipes();
@@ -1708,13 +2351,13 @@ program.name(invokedAs).description(
   writeOut: (text) => process.stdout.write(named(text, invokedAs)),
   writeErr: (text) => writeStderr(text)
 });
-function integer(value) {
+function integer2(value) {
   if (!/^\d+$/.test(value))
     throw new InvalidArgumentError("expected a non-negative integer");
   return Number.parseInt(value, 10);
 }
 function activityLimit(value) {
-  const limit = integer(value);
+  const limit = integer2(value);
   if (limit < 1 || limit > ACTIVITY_MAX_LIMIT) {
     throw new InvalidArgumentError(
       `expected an integer from 1 to ${ACTIVITY_MAX_LIMIT}`
@@ -1763,7 +2406,7 @@ async function confirmRepoLogin(baseUrl, source, path) {
   trustHost(baseUrl);
   return true;
 }
-async function withConfig(jsonFlag, mutating, run2) {
+async function withConfig(jsonFlag, mutating, run3) {
   const resolved = resolveConfig();
   for (const warning of resolved.warnings) writeStderr(warning + "\n");
   if (resolved.kind === "error") {
@@ -1796,25 +2439,25 @@ async function withConfig(jsonFlag, mutating, run2) {
       );
       return exitWith(1);
     }
-    return execute(again.config, jsonFlag, mutating, run2);
+    return execute(again.config, jsonFlag, mutating, run3);
   }
-  return execute(resolved.config, jsonFlag, mutating, run2);
+  return execute(resolved.config, jsonFlag, mutating, run3);
 }
-async function execute(config, jsonFlag, mutating, run2) {
+async function execute(config, jsonFlag, mutating, run3) {
   const client = new Client(config);
   const hostNotice = mutating ? `\u2192 ${config.baseUrl}
 ` : "";
   try {
-    const output = await run2({ client, config });
+    const output = await run3({ client, config });
     writeStderr(hostNotice);
     if (output.notice !== void 0) writeStderr(output.notice);
     process.stdout.write(jsonFlag ? json(output.json) : output.human);
     return exitWith(output.exitCode ?? (output.partial === true ? 1 : 0));
   } catch (error) {
-    return fail(explainExpertRefusal(error, config.token), hostNotice);
+    return fail2(explainExpertRefusal(error, config.token), hostNotice);
   }
 }
-async function fail(error, hostNotice) {
+async function fail2(error, hostNotice) {
   if (error instanceof UsageError) {
     writeStderr(error.message + "\n");
     return exitWith(2);
@@ -1858,7 +2501,7 @@ async function fail(error, hostNotice) {
 program.command("ready").description("issues ready to work, highest priority first").option(
   "--claim",
   "claim the team's next ready, unassigned issue in one server-side request (team from --team, HARNESS_TEAM or the repo config; no paging flags)"
-).option("--team <key>", "team filter; with --claim, the team to claim from").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+).option("--team <key>", "team filter; with --claim, the team to claim from").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   if (opts.claim === true) requireReadyClaimArgs(opts);
   await withConfig(
     opts.json === true,
@@ -1866,7 +2509,7 @@ program.command("ready").description("issues ready to work, highest priority fir
     (ctx) => ready(ctx, opts)
   );
 });
-program.command("blocked").description("issues waiting on a blocker").option("--team <key>", "team filter").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+program.command("blocked").description("issues waiting on a blocker").option("--team <key>", "team filter").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
@@ -1879,7 +2522,7 @@ program.command("list").description("list issues with filters").option("--status
 ).option("--created-by <who>", "me or a creator user id").option(
   "--involved <who>",
   "me for issues created by, assigned to, or mentioning you"
-).option("--priority <name>", "urgent | high | medium | low | none").option("--label <name>", "label filter").option("--type <type>", "task | bug | feature | epic").option("--search <query>", "full-text search").option("--team <key>", "team filter").option("--parent <id>", "children of an epic").option("--scope <scope>", "all | archived").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+).option("--priority <name>", "urgent | high | medium | low | none").option("--label <name>", "label filter").option("--type <type>", "task | bug | feature | epic").option("--search <query>", "full-text search").option("--team <key>", "team filter").option("--parent <id>", "children of an epic").option("--scope <scope>", "all | archived").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
@@ -1888,16 +2531,16 @@ program.command("list").description("list issues with filters").option("--status
 });
 program.command("search").description(
   "search by meaning \u2014 ranked, exact identifier first; use list --search for paginated filtering"
-).argument("[query...]").option("--limit <n>", "maximum results (default 10, capped at 20)", integer).option(
+).argument("[query...]").option("--limit <n>", "maximum results (default 10, capped at 20)", integer2).option(
   "--page <n>",
   "(deprecated, ignored \u2014 results are ranked and capped)",
-  integer
+  integer2
 ).option("--all", "(deprecated, ignored \u2014 results are ranked and capped)").option("--json", "emit JSON").action(
-  async (query, opts) => {
+  async (query2, opts) => {
     await withConfig(
       opts.json === true,
       false,
-      (ctx) => search(ctx, query, opts)
+      (ctx) => search(ctx, query2, opts)
     );
   }
 );
@@ -2117,7 +2760,7 @@ plan.command("create").description("create a plan from a JSON or YAML file (the
     return planCreate(ctx, readPlanFile(opts.file), { ...opts, team: team2 });
   });
 });
-plan.command("list").description("a team's plans, newest first: root, status, held, revision and title").option("--team <key>", "the team whose issues root the plans (or HARNESS_TEAM)").option("--status <status>", PLAN_STATUSES.join(" | ")).option("--limit <n>", `maximum plans (default 50, at most ${PLAN_LIST_MAX_LIMIT}; there are no pages)`, integer).option("--json", "emit JSON").action(async (opts) => {
+plan.command("list").description("a team's plans, newest first: root, status, held, revision and title").option("--team <key>", "the team whose issues root the plans (or HARNESS_TEAM)").option("--status <status>", PLAN_STATUSES.join(" | ")).option("--limit <n>", `maximum plans (default 50, at most ${PLAN_LIST_MAX_LIMIT}; there are no pages)`, integer2).option("--json", "emit JSON").action(async (opts) => {
   requirePlanListArgs(opts);
   await withConfig(opts.json === true, false, (ctx) => planList(ctx, opts));
 });
@@ -2137,7 +2780,7 @@ plan.command("edit").description("change step executors and keys, and budgets, f
     return planEdit(ctx, id, readPlanFile(opts.file));
   });
 });
-plan.command("release").description("release a plan as yourself: freeze its next revision and let its ready steps run").argument("[plan]", PLAN_ARGUMENT).option("--collaborator <who>", "a person of this organization (id or email) for the plan room (repeatable)", collect, []).option("--retry-budget <n>", "retries per failed Operator step", integer).option("--spend-budget-cents <n>", "the plan's spend budget; needed to release Operator steps", integer).option("--json", "emit JSON").action(
+plan.command("release").description("release a plan as yourself: freeze its next revision and let its ready steps run").argument("[plan]", PLAN_ARGUMENT).option("--collaborator <who>", "a person of this organization (id or email) for the plan room (repeatable)", collect, []).option("--retry-budget <n>", "retries per failed Operator step", integer2).option("--spend-budget-cents <n>", "the plan's spend budget; needed to release Operator steps", integer2).option("--json", "emit JSON").action(
   async (id, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
       if (id === void 0) throw new UsageError("usage: harness plan release <plan-id-or-root>");
@@ -2178,7 +2821,7 @@ var NO_OBJECTIVE_TEXT = "By reference only: never the objective's text, which th
 program.command("jobs").description("Operator jobs you see in the workbench, newest first").option(
   "--status <states>",
   `comma-separated job states (${JOB_STATES.join(", ")}) or open | waiting | done`
-).option("--mine", "only jobs you own").option(`--limit <n>`, `jobs per page (default 20, max ${JOBS_MAX_LIMIT})`, integer).option("--all", `follow every page (up to ${JOBS_MAX_PAGES})`).option("--json", "emit JSON").addHelpText("after", `
+).option("--mine", "only jobs you own").option(`--limit <n>`, `jobs per page (default 20, max ${JOBS_MAX_LIMIT})`, integer2).option("--all", `follow every page (up to ${JOBS_MAX_PAGES})`).option("--json", "emit JSON").addHelpText("after", `
 ${NO_OBJECTIVE_TEXT}
 `).action(async (opts) => {
   requireJobsArgs(opts);
@@ -2195,7 +2838,7 @@ ${NO_OBJECTIVE_TEXT}
     (ctx) => jobShow(ctx, id, { changes: opts.changes, people: opts.people })
   );
 });
-program.command("watch").description("follow an Operator job until it completes, fails, or waits for a person").argument("[id]").option("--after <seq>", "start after this event sequence (default 0: the whole history)", integer).option("--through-waits", "keep following while a person has to act, instead of stopping").option("--json", "emit one JSON document when the watch ends").addHelpText(
+program.command("watch").description("follow an Operator job until it completes, fails, or waits for a person").argument("[id]").option("--after <seq>", "start after this event sequence (default 0: the whole history)", integer2).option("--through-waits", "keep following while a person has to act, instead of stopping").option("--json", "emit one JSON document when the watch ends").addHelpText(
   "after",
   `
 Polls the job's events every 2 s, and every 10 s while the job is paused or
@@ -2416,7 +3059,7 @@ program.command("attach-image").description("upload an image; prints markdown to
   });
 });
 var project = program.command("project").description("projects");
-project.command("list").option("--search <query>", "full-text search").option("--state <state>", "project state filter").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+project.command("list").option("--search <query>", "full-text search").option("--state <state>", "project state filter").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
@@ -2464,7 +3107,7 @@ milestone.command("create").option("--project <id>", "project id (required)").op
   );
 });
 var doc = program.command("doc").description("documents");
-doc.command("list").option("--search <query>", "full-text search").option("--limit <n>", "page size", integer).option("--page <n>", "page number", integer).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
+doc.command("list").option("--search <query>", "full-text search").option("--limit <n>", "page size", integer2).option("--page <n>", "page number", integer2).option("--all", "follow every page").option("--json", "emit JSON").action(async (opts) => {
   await withConfig(
     opts.json === true,
     false,
@@ -2496,8 +3139,8 @@ doc.command("update").argument("[id]").option("--title <title>").option("--conte
     });
   }
 );
-var link = program.command("link").description("URLs attached to an issue (distinct from dep relations)");
-link.command("list").argument("[issue]").option("--json", "emit JSON").action(async (issue, opts) => {
+var link2 = program.command("link").description("URLs attached to an issue (distinct from dep relations)");
+link2.command("list").argument("[issue]").option("--json", "emit JSON").action(async (issue, opts) => {
   await withConfig(opts.json === true, false, (ctx) => {
     if (issue === void 0)
       throw new UsageError("usage: harness link list <issue>");
@@ -2505,7 +3148,7 @@ link.command("list").argument("[issue]").option("--json", "emit JSON").action(as
     return linkList(ctx, issue);
   });
 });
-link.command("add").argument("[issue]").argument("[url]").option("--title <title>", "link title").option("--json", "emit JSON").action(
+link2.command("add").argument("[issue]").argument("[url]").option("--title <title>", "link title").option("--json", "emit JSON").action(
   async (issue, url, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
       if (issue === void 0 || url === void 0) {
@@ -2518,7 +3161,7 @@ link.command("add").argument("[issue]").argument("[url]").option("--title <title
     });
   }
 );
-link.command("update").argument("[issue]").argument("[id-or-url]").option("--url <url>", "replacement URL").option("--title <title>", "replacement title; pass an empty value to clear").option("--json", "emit JSON").action(
+link2.command("update").argument("[issue]").argument("[id-or-url]").option("--url <url>", "replacement URL").option("--title <title>", "replacement title; pass an empty value to clear").option("--json", "emit JSON").action(
   async (issue, idOrUrl, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
       if (issue === void 0 || idOrUrl === void 0) {
@@ -2530,7 +3173,7 @@ link.command("update").argument("[issue]").argument("[id-or-url]").option("--url
     });
   }
 );
-link.command("rm").argument("[issue]").argument("[id-or-url]").option("--json", "emit JSON").action(
+link2.command("rm").argument("[issue]").argument("[id-or-url]").option("--json", "emit JSON").action(
   async (issue, idOrUrl, opts) => {
     await withConfig(opts.json === true, true, (ctx) => {
       if (issue === void 0 || idOrUrl === void 0) {
@@ -2648,14 +3291,14 @@ var tools = program.command("tools").description(
   requireToolsOpts(opts);
   await withConfig(opts.json === true, false, (ctx) => toolsList(ctx, opts));
 });
-tools.command("search").description("search what Operator can use now by keyword, best match first").argument("[query...]").option("--domain <domain>", "only this domain").option("--cursor <cursor>", "continue from a page's cursor (from the paging notice)").option("--all", "follow every page").option("--json", "emit JSON").action(async (query, opts) => {
+tools.command("search").description("search what Operator can use now by keyword, best match first").argument("[query...]").option("--domain <domain>", "only this domain").option("--cursor <cursor>", "continue from a page's cursor (from the paging notice)").option("--all", "follow every page").option("--json", "emit JSON").action(async (query2, opts) => {
   const merged = { ...tools.opts(), ...opts };
-  if (query.length === 0) {
+  if (query2.length === 0) {
     throw new UsageError("usage: harness tools search <query> [--domain <domain>] [--all]");
   }
-  requireSearchQuery(query.join(" "));
+  requireSearchQuery(query2.join(" "));
   requireToolsOpts(merged);
-  await withConfig(merged.json === true, false, (ctx) => toolsSearch(ctx, query.join(" "), merged));
+  await withConfig(merged.json === true, false, (ctx) => toolsSearch(ctx, query2.join(" "), merged));
 });
 tools.command("domains").description("every domain Operator can use capabilities in, with how many").option("--json", "emit JSON").action(async (opts) => {
   const parent = tools.opts();
@@ -2674,7 +3317,7 @@ program.command("skills").description("the organization's skills assigned to Ope
   await withConfig(opts.json === true, false, (ctx) => skillsList(ctx));
 });
 program.command("mcp").description("run the MCP server over stdio (for agents)").action(async () => {
-  const { startMcpServer } = await import("./server-F6YRKNC2.js");
+  const { startMcpServer } = await import("./server-TRXBTJSA.js");
   await startMcpServer(invokedAs);
 });
 var keys = program.command("keys").description("the org's provider API keys, handed to tooling without printing them").enablePositionalOptions();
@@ -2688,14 +3331,48 @@ keys.command("exec").description(
   "pass only these provider slugs (comma-separated, repeatable); default: everything stored",
   collect,
   []
-).option("--json", "accepted for uniformity; stdout belongs to the command, so it changes nothing").passThroughOptions().action(async (command, opts) => {
+).option("--json", "accepted for uniformity; stdout belongs to the command, so it changes nothing").passThroughOptions().action(async (command2, opts) => {
   const only = opts.only.flatMap((value) => value.split(","));
   await withConfig(
     false,
     false,
-    (ctx) => exec(ctx, { command, override: opts.override === true, only })
+    (ctx) => exec(ctx, { command: command2, override: opts.override === true, only })
   );
 });
+var code = program.command("code").description("sync and inspect a code-index worktree overlay");
+code.command("sync").description("sync an overlay on a server-built GitHub base (needs harness:read and harness:write)").option("--path <directory>", "Git worktree (defaults to the current directory)").option("--skipped", "include the server base\u2019s skipped-files report").option("--json", "emit JSON").action(async (opts) => {
+  const target = enterWorktree(opts);
+  await withConfig(opts.json === true, true, (ctx) => sync(ctx, target));
+});
+code.command("status").description("inspect this worktree view; --skipped also asks for base status (needs harness:write)").option("--path <directory>", "Git worktree (defaults to the current directory)").option("--skipped", "include the server base\u2019s skipped-files report").option("--json", "emit JSON").action(async (opts) => {
+  const target = enterWorktree(opts);
+  await withConfig(opts.json === true, opts.skipped === true, (ctx) => status2(ctx, target));
+});
+for (const operation of ["search", "explain", "affected", "context"]) {
+  const query2 = code.command(operation).description({ search: "find indexed declarations", explain: "explain an opaque symbol ID and its callers", affected: "find impact from symbol IDs or file paths", context: "retrieve indexed source snippets within a token budget" }[operation]);
+  if (operation === "search" || operation === "explain" || operation === "context") query2.argument("[value]");
+  if (operation === "search") query2.option("--kind <kind>").option("--path-prefix <prefix>").option("--limit <n>", "1 to 100", integer2);
+  if (operation === "context") query2.option("--symbol <id>", "opaque ID from search");
+  if (operation === "context" || operation === "explain") query2.option("--budget-tokens <n>", "indexed snippet token budget", integer2);
+  if (operation === "affected") query2.option("--symbol <id>", "repeat for multiple IDs", (value, all) => [...all, value], []).option("--file <path>", "repeat for multiple paths", (value, all) => [...all, value], []).option("--depth <n>", "1 to 6", integer2).option("--include-ambiguous", "follow possible bindings too").option("--include-types", "follow type dependents too");
+  query2.option("--path <directory>", "Git worktree").option("--json", "emit response data, meta and guidance");
+  const run3 = async (value, opts) => {
+    const target = enterWorktree({ path: opts["path"] });
+    const params = {
+      ...operation === "search" || operation === "context" ? { q: value } : {},
+      ...operation === "explain" ? { symbol: value } : operation === "context" ? { symbol: opts["symbol"] } : {},
+      ...operation === "affected" ? { symbols: opts["symbol"], files: opts["file"], depth: opts["depth"], includeAmbiguous: opts["includeAmbiguous"], includeTypes: opts["includeTypes"] } : {},
+      kind: opts["kind"],
+      pathPrefix: opts["pathPrefix"],
+      limit: opts["limit"],
+      budgetTokens: opts["budgetTokens"]
+    };
+    validateQuery(operation, params);
+    await withConfig(opts["json"] === true, false, (ctx) => query(ctx, operation, params, target));
+  };
+  if (operation === "affected") query2.action(async (opts) => run3(void 0, opts));
+  else query2.action(run3);
+}
 var review = program.command("review").description("a pull request's enforced Review Council gate, and a retry of its latest attempt");
 review.command("status").description("the gate's enforced and advisory status, and a failed latest attempt with what comes next").argument("<pr>", "owner/repo#<pr>, the pull request URL, or <pr> with --repo or this checkout's origin").option("--repo <owner/repo>", "the repository a bare pull request number belongs to").option("--json", "emit JSON").action(async (pr, opts) => {
   const ref = parsePullRequest(pr, opts.repo);
@@ -2710,7 +3387,7 @@ review.command("retry").description(
 program.command("login").description("sign in via the browser (infra.one session)").option("--url <url>", "host to sign in to").option("--no-browser", "print the URL and prompt for a pasted token instead").option(
   "--timeout <ms>",
   "how long to wait for the browser callback",
-  integer
+  integer2
 ).option("--json", "emit JSON").action(
   async (opts) => {
     const repoLookup = findRepoConfig();
@@ -2801,6 +3478,10 @@ try {
   if (notice !== null) writeStderr(notice);
 } catch {
 }
+if (invokedAs === "operator") {
+  const deprecation = operatorDeprecationNotice();
+  if (deprecation !== null) writeStderr(deprecation);
+}
 if (invokedAs === "operator") layoutOperatorHelp(program);
 if (argv.length <= 2) {
   program.outputHelp({ error: true });